Automation Center Reference Public

Building & Running Automations

Work the Automation Center day to day: the five tabs, the five-step builder wizard field by field, previewing against real records, publishing in Observe, promoting to Live, cloning, pausing, and reading a finished run.

Guide version: r1 Module version: 0.3.3 Updated: 2026-09-04 Estimated time: 18 min 1 views
Daily Operations

Building & Running Automations

Everything you do after the module is switched on: build a rule in the wizard, watch it decide against real records, publish it so it runs on a schedule, and — only once it has proved itself on your data — let it act. This page follows that order, because the product does.

ℹ️
Nothing here can change a record by accident. A new automation is always saved as a draft in Observe mode, and every path to Live goes through the four checks in Promoting to Live. Publish only in Observe and the worst outcome is a report you disagree with.

The page: five tabs, five questions

Automation Center is one page (Sidebar → Administration). Switching tabs never reloads it; each tab is fetched the first time you open it and then cached, and the tab you were last on is remembered. Three of the five appear only if you hold their permission, so a colleague's screen may legitimately show fewer than yours.

TabThe question it answersNeeds
Overview Is the engine healthy, and does anything need me? Counters for draft / active / paused / needs review, the registered types and whether each is available, the registry checksum, and the last five runs. automations
Automations What rules exist, in what mode, on what schedule? One row each, with last run, next run, status and the action menu. automations
Runs & Logs What has actually happened? Every occurrence of every automation, newest first, each opening into the run detail. automations_logs
Analytics What is the pattern? Totals across recent runs, the completed / exceptions / failed split, and reason codes ranked by frequency. automations_analytics
Settings Where are the controls? The dispatch job name, the registry checksum and the type table — plus a pointer to Cron Manager, which owns scheduling. automations_settings

The New automation button sits on the tab bar and shows only while Overview or Automations is active — it belongs to those two tabs, not to the page.

????
The status filters are pre-selected, and that hides rows. On Automations, archived is unchecked by default. On Runs & Logs the filter offers five statuses, but a run can also end skipped_overlap, cancelled or timed_out — none of which has a checkbox. Deselect every option to drop the filter entirely and see all of them.

The builder: five steps

Everything about an automation is set in one modal wizard whose stepper you can click through in any order. The steps are guidance, not security: every value is revalidated server-side by the owning type's own handler, so skipping ahead cannot smuggle a bad configuration past a rule.

1 · Type
2 · Action
3 · Scope & rules
4 · Schedule & safety
5 · Review & preview

Step 1 — Type, title, description

The type dropdown lists only types that are currently available: one whose owning module is switched off does not appear, though Overview still lists it as registered-but-inactive. Today the one shipped type is attendance.auto_decision, contributed by HumanResource.

Title is required and is what every list, run row and audit entry will call this rule — write it so a colleague reading the log next quarter knows what it does. Description is optional free text. Changing the type clears your conditions, because condition fields come from the type's own catalogue and a rule written against attendance fields is meaningless under another type.

Step 2 — Action: what the rule does, and how carefully

Phase 1 is approve-only. There is no Reject anywhere in this module, because the attendance handler refuses any other action — an automation can move work forward, never backwards.

FieldDefaultWhat it means
Look back (days)7 1–365 Only records this many days back are considered — what keeps a routine daily run away from a historical backlog. Set it wide and the first run meets years of records.
Settle delay (hours)12 0–720 Wait this long after a record completes, so corrections and late edits have time to land. A younger record is skipped as NOT_YET_SETTLED and reconsidered later.
Overtime policyskip The one setting here with real consequences — see below.

The builder rewrites the help text as you change the overtime policy:

Safest, and why it is the default. Any record carrying overtime is left for a person, with reason code OVERTIME_PRESENT. The automation clears the uncontroversial majority and hands you back a short queue of the ones that genuinely needed a human.

Approve base hours, reject the overtime. The measured hours are still stored — no policy here destroys a number. What changes is the decision recorded against them, so unapproved overtime is withheld at read time and stops reaching payroll until a reviewer says otherwise. The choice is reversible, and the preview warns you by number before you can go live.

Approve both. The record is approved with its computed overtime intact — nothing is reset, but the overtime is accepted without review. Use this only where overtime is already controlled upstream (a hard cap, a separate approval step, a scheduling rule).

If Overtime Approval is off for your company, "exclude overtime" does nothing. The underlying calculation only acts on the overtime decision when that tenant setting is on; with it off, overtime is always kept as computed. The builder detects this and prints a note under the dropdown rather than letting the option imply an effect it cannot have.

Step 3 — Scope and rules

Employee scope is one picker holding teams and individual members, grouped with Teams first — a flat list buries a handful of teams under every employee in the company. Search matches inside both groups. A token that no longer resolves (a deleted member, a removed team) is kept in raw form rather than quietly disappearing, because silently dropping it would rewrite your scope on the next save without you ever seeing it go.

Empty means everyone, not nobody. The placeholder reads All employees and that is exactly what it does — leave it untouched and the automation processes every employee in the company. If you mean "just this department", you must say so. Step 5 reads your scope back as labels so you can see which it is before saving.

Conditions are rows of field · operator · value, and a record must satisfy every one — they are ANDed. Anything that fails is left pending with RULE_NOT_MET, never silently ignored. Fields come from the selected type; for attendance they include log type, worked minutes, record age in hours, whether a schedule exists, whether existing overtime is present, whether the payroll date is locked, whether a schedule-change request is pending, and department / establishment membership. Choosing a field narrows the operators to the ones it supports, and the unary IS_TRUE / IS_FALSE hide the value box because they take none.

????
You do not need any conditions at all. The handler applies its own mandatory baseline first — a locked payroll date, a pending schedule-change request, the settle delay and the overtime policy all skip a record before your rules are consulted. An empty rule tree is not what makes a record eligible.

Step 4 — Schedule and safety

FieldDefaultWhat it controls
Schedule expression*/15 * * * * A five-field cron expression, validated by the platform's single cron parser — an invalid one is refused on save, not discovered later.
TimezoneAsia/Manila The expression is matched in this zone, so "07:00" means seven in the morning where the work happens, not UTC.
If the previous run is still activeSkip this occurrence Overlap policy. Skip drops the occurrence; Queue the latest holds it for after. Skip is the safe default — a run overlapping itself is a signal, not something to pile onto.
Records per batch250 How many records the engine asks for at a time. It also sets the preview's sample size.
Maximum records per run1000 The hard ceiling for one occurrence. Anything beyond it waits for the next run rather than turning one tick into an unbounded job.
First live run limit50 The cap on the first run allowed to change records — see Promoting to Live.

Step 5 — Review and preview

The Review pane reads the configuration back before anything is written: title, type, lookback, settle delay, overtime policy, schedule with its timezone, scope as labels (not raw tokens), and the number of conditions. It exists so you can catch the scope you forgot to narrow.

Previewing against real data

Run preview evaluates your unsaved configuration against your real records and reports what it would do. It changes nothing, needs no publish, and runs the same handler, candidate provider and rule evaluator a real run does — there is deliberately no second code path, because a preview that could disagree with the run it predicts would be worse than no preview at all.

340 matching record(s). In this sample of 250: 214 would be acted on, 36 left for review.

12 record(s) already have overtime recorded. With this overtime setting,
a live run would reset those hours to zero.

NOT_YET_SETTLED: 21
OVERTIME_PRESENT: 12
RULE_NOT_MET: 3
The total. How many records match the lookback window and scope at all. Far larger than expected usually means an empty scope (= everyone) or too wide a lookback. A ? means the type cannot count cheaply — judge by the sample instead.
The sample. The preview evaluates up to Records per batch (250 by default), so on a large tenant it is a slice. The proportions are representative; the absolute numbers are not the whole population.
Would act vs. left for review. The split you actually care about. Acting on everything means the rule is not narrowed enough; acting on nothing usually means a settle delay longer than your records are old.
The overtime warning, if it appears. The one number describing a change that feels irreversible, shown before you can go live precisely so it is never a surprise.
The reason breakdown. Every skip is attributed. If one code dominates, that is your rule telling you which assumption is doing the work.

Saving — always a draft

Save writes a draft in Observe mode, whatever else you did in the wizard. It never schedules anything and never grants the rule the ability to act; each save of an existing automation increments its revision.

ℹ️
A published (active) automation cannot be edited in place. Save is refused with "Pause this automation before editing it". Its configuration is what its runs are judged against, so it is not something to change underneath a run in flight — pause, edit, resume. If it was Live, expect to prove it again (see the configuration check).

Publishing in Observe

Publish (Observe) in the row's action menu turns a draft into a scheduled rule: status active, next occurrence computed from your expression and timezone, and you recorded as the publisher — the authority its runs are checked against from then on. Needs automations_publish.

From this moment the automation runs on its schedule and changes nothing. It evaluates records, records an outcome and a reason for each, and files a run you can read. That is the whole point of the mode.

The Observe period — what to compare

There is no fixed length. Observe answers "would I have made these same decisions?", so run it long enough to cover the variation your data actually has — a payroll cutoff, a holiday, a week with a night shift in it. For each run:

CompareAgainstA disagreement means
Would act countWhat you approved by hand that day Far lower: too strict, or a settle delay longer than your working rhythm. Far higher: scope or conditions too loose.
The reason breakdownYour own reasons for leaving things pending An unexpected dominant code is the fastest way to find the assumption you got wrong.
Individual record outcomesA handful you know the answer to Spot-check both directions: one it would approve that you would not, and one it skipped that you would have cleared.
Run statusPlain completed Completed with exceptions or failed — not ready to be trusted unattended.

Promoting to Live

Switch to Live mode appears on an active automation still in Observe, and it is the only action in this module that asks you to confirm. Four conditions must all hold, and the refusal names the one that failed:

You hold automations_go_live. Separate from automations_publish on purpose: being allowed to schedule a rule that only reports is not the same as letting it change payroll inputs unattended.
The type supports it. The owning module declares whether live application exists at all. A type whose handler cannot apply is never promotable, whatever your permissions say.
There is a completed run. An automation that has never finished a run has never been shown to be correct. The Observe run costs nothing but time.
That run was of this configuration. The stored fingerprint of the settings must match the last completed run's. Preview, then widen the scope, then go live, and the run that "proved" the rule was watching a different rule.
The fourth check is the one that surprises people. Any edit — a wider scope, one more day of lookback, a changed condition — invalidates the evidence, and the refusal reads: "The configuration has changed since the last completed run… Run it once more in Observe mode, then switch to Live." That is working as designed. Publish, let one Observe run complete, then promote.

The first live run is capped

An Observe run proves the rule selects the right records. It cannot prove the approvals are right, because nothing was approved. So the first run that actually changes records — the one nobody has seen the results of — is bounded, and a mistake that survived Observe costs a reviewable handful instead of a thousand records. Once one live run has completed, the normal ceiling applies.

ℹ️
The cap is your First live run limit, defaulting to 50 in the builder. The engine takes the lower of that and Maximum records per run. Its built-in fallback of 25 applies only when the safety block carries no positive first-live limit — a wizard-created automation always has one, so 50 is the number you will normally see. Set it lower for a nervous first promotion.

Switching back to Observe

Switch back to Observe is always available on a live automation, needs no confirmation, and needs no go-live permission — only automations_update. Demotion is always safe, so it requires no evidence. Publishing and changing mode are separate actions because they answer separate questions: publish asks should this run on a schedule?, mode asks should it be allowed to change records? — and the second must stay reversible, so an operator watching a live run behave badly can stop it acting without archiving the rule and losing its configuration. The two directions are two menu entries, never a toggle, so the menu always states what will happen rather than what is currently true.

Pause, resume, archive

Pause — stop it running, keep everything

Status becomes paused; nothing is due, so the dispatcher will not pick it up. Configuration, publisher, mode and run history are untouched. This is also the prerequisite for editing an active automation. Needs automations_update.

Resume — put it back on the schedule

Recomputes the next occurrence from the current expression and timezone and sets the status back to active. Offered for both paused and needs review, so it is also how you clear a rule the engine parked once you have fixed the cause. An invalid schedule blocks the resume rather than leaving a rule that can never fire. Needs automations_update.

Archive — retire it without losing it

Status becomes archived. Archived rules are filtered out of the Automations tab by default (tick Archived to see them) and their runs stay in Runs & Logs — history is not rewritten. Archive is not a dead end either: Clone is offered on archived rows precisely so an old configuration can be resurrected. Needs automations_delete.

Clone — and exactly what it resets

Cloning builds a variant — same rules, different department; same schedule, different cutoff — without retyping a five-step wizard. It is offered on every status, archived included, and gated on automations_create, because creating is what it does. The copy carries the configuration and gets a title with a Copy suffix. What it deliberately does not inherit is the whole design — each reset is a way this could otherwise go wrong:

ResetToWhy it must be
Identifiera fresh oneIt is unique and seeds a run's idempotency key. Two automations sharing it would collide on the same due occurrence, so one would silently never run.
StatusdraftCloning a live rule into a second live rule that starts acting the moment it is saved is precisely the accident to prevent.
ModeObserveA copy of a live rule starts by watching, like everything else.
Next runnoneNothing is due, so the dispatcher cannot pick the copy up before you have looked at it.
PublisherclearedThis is the authority anchor a run is revalidated against. Inheriting it would let a copy act with the original publisher's authority without anyone having published it.
Revision1A copy is a new object, not the next revision of the source.
Last-run fieldsclearedThose are snapshots of the source's runs. The copy has no history.

Runs and run items are not copied — they belong to the source. Because the copy has no completed run of its own, it must serve its own Observe period before it can be promoted, exactly like a rule built from scratch. The audit trail records the clone as a creation and names the source, so the log answers "where did this rule come from?".

ℹ️
The copy's configuration fingerprint is carried over — it has to be, so the copy's stored hash matches its stored settings. It is not evidence that the copy has been observed: the live gate keys on the pair (this automation, this hash), never on the hash alone.

Run Now

Run now queues an occurrence outside the schedule. It is offered on active automations and needs automations_run_now. It is not a shortcut past anything: the run is created as queued, marked as manually triggered, and goes through the normal executor path in the automation's current mode — an Observe automation still observes. The confirmation says so plainly: it "starts on the next dispatcher tick", within a minute, not instantly.


Reading a run

Open any row in Runs & Logs with the magnifier. The detail runs top-down, from the summary to the individual records.

The four tiles

Records evaluated · Would act · Skipped · Failed. Skipped is the designed outcome — records deliberately left for a person — so it never degrades the run's status the way a failure does.

The run facts

Automation, run identifier, correlation id, scheduled time, status, duration and mode. Mode is read from the run's own record, not the snapshot, because it says what the run actually did — including a demotion applied after it was queued.

????
The configuration snapshot

Lookback, settle delay, overtime policy and schedule expression, frozen when the run started. Later edits do not change what a past run did, so this is the honest answer to "what rule was in force?".

Reasons and records

The reason breakdown counts every code across the run; below it the first records are listed as subject, outcome and reason. Every record has a reason — nothing is skipped in silence.

On a Live run, the "Would act" tile reads 0. Not a fault in the run — a gap in the current tiles. In Observe a positive outcome is a prediction and is counted as would act; in Live it is a real change, counted separately as approved, and the tiles do not render that counter yet. Read the APPROVED line in the reason breakdown for the number a live run actually changed. The proper operations view is Milestone 4 work — see Research & Known Gaps.

The reason codes you will see

These come from the attendance type's handler, in the order it applies them. The first four are its own mandatory baseline, checked before your conditions.

CodeOutcomeMeaning
PAYROLL_LOCKEDskippedThe payroll date is locked.
SCHEDULE_CHANGE_PENDINGskippedA schedule-change request is outstanding, so the record is still moving.
NOT_YET_SETTLEDskippedYounger than your settle delay; reconsidered on a later run.
OVERTIME_PRESENTskippedOvertime is recorded and your policy is skip.
RULE_NOT_METskippedYour own conditions did not all pass.
ELIGIBLEwould approveObserve: one the rule would have acted on.
APPROVEDapprovedLive: the record was actually approved.
TRANSITION_ERRORfailedThe approval itself threw. One bad record does not abandon the rest of the batch.
a service codeskippedThe record stopped being eligible between evaluation and approval — the shared transition service refused, and its own reason is recorded rather than a bare "skipped".

What a healthy run looks like

SignalHealthyLook into it
Statuscompleted completed with exceptions — records failed. failed — the run itself stopped.
Failed count0 Anything above zero. Open the record outcomes and read the TRANSITION_ERROR rows.
Records evaluatedSteady run to run, well under your maximum Pinned exactly at Maximum records per run — the run is truncated and there is a backlog it never reaches.
Would act / approvedA plausible fraction of records evaluated Zero on every run (never fires) or 100% (filtering nothing).
SkippedPresent, with a reason mix you recognise One code suddenly dominating — usually an upstream change, not an automation change.
DurationShort and stable Climbing run to run, or long enough that occurrences overlap and get skipped.
Automation statusactive needs review — the engine parked it; it will not run until the cause is resolved.
????
The short version. Build → preview → save (draft) → publish in Observe → let it run and compare → promote to Live → watch the first, capped run → then check Runs & Logs on the same rhythm you check anything else touching payroll. Anything that surprises you is one click from Switch back to Observe.

Next: who may do each of these, whose authority a live run acts with, and how the schedule actually reaches the engine — Permissions, Authority & Scheduling.

Was this guide helpful?

Report a content problem