Workflows
Remediation playbooks. Workflows graduate draft → approved → auto as their eval scores accrue; auto-execution can be killed per-workflow at any time. A run executes on its own only when no governance policy holds it and its playbook has auto-execution switched on and passes its confidence and risk gates; every other run waits in Approvals for an operator.
No workflows yet
Remediation playbooks live here. Promotion to auto requires governance sign-off + a run of successful dry-runs — start with a draft.