Active
AI Generated
Risk-Based Routing
Risk-tier renewal decisions
Description
This demo extends Intelligent Cert Lifecycle with AI-assessed risk scoring per certificate. A switch routes low, medium, and high risk renewals to different approval and execution paths.
Why it matters
- Risk scoring separates low-touch auto-renewals from high-risk changes that need human approval.
- One switch step routes by AI-assessed tier instead of brittle per-host workflow forks.
- Blast radius analysis gives approvers context before they sign off on production cert changes.
AO building blocks
Automation orchestrator step types this workflow uses on the canvas. See all building blocks
-
Triggers
Manual trigger
Starts a workflow when a user clicks Run in the UI or calls the workflow execution API — the simplest entry point for on-demand runs like demos, break-glass remediation, or operator-initiated changes. No extra configuration is required, and runs appear in history with the triggering user as the source.
-
AI & integrations
Task agent
Adds LLM reasoning to a workflow — the step receives a natural-language prompt, can call enabled tools, and returns structured output that downstream steps reference through expressions. Use it for unstructured data (logs, tickets, alerts) to summarize, classify, triage, and recommend remediation actions; pair with an approval step for human oversight.
-
Logic
Switch step
Evaluates conditions and routes execution to the first matching branch, supporting up to 100 ordered paths plus a fallback when nothing matches. Use it to branch on severity tiers, environment (dev/staging/prod), or AI agent output categories where a binary conditional isn't enough.
-
Approval
Approval step
Pauses the branch and creates an approval request; an approver reviews context, approves or rejects, and the workflow continues on the matching path. Place approvals before destructive or production changes, with configurable approver users/groups, a decision window, and fallback behavior if no one responds in time.
-
AAP execution
AAP job template
Launches a single Ansible Automation Platform job template from the workflow, polling until the job completes and exposing results to downstream steps. The standard bridge between automation orchestrator reasoning and AAP execution — one playbook with resolved inventory, credentials, limits, and extra vars.
Interactive Experience
Planned scope
- Risk scoring per certificate (low/medium/high)
- Switch-step routing to different approval flows per risk level
- Blast radius analysis
- Multiple hosts with different cert types
Workflow
flowchart LR
A@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/manual-trigger.png", label: "Cert Expiry Event", pos: "b", h: 96, constraint: "on" } --> B@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/task-agent.png", label: "AI Risk Assessment", pos: "b", h: 96, constraint: "on" }
B --> C@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/switch-node.png", label: "Risk Tier", pos: "b", h: 96, constraint: "on" }
C -->|Low| D@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Auto-Renew", pos: "b", h: 96, constraint: "on" }
C -->|Medium| E@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Notify + Renew", pos: "b", h: 96, constraint: "on" }
C -->|High| F@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/approval-node.png", label: "Approval Required", pos: "b", h: 96, constraint: "on" }
F --> F1@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Renew After Approval", pos: "b", h: 96, constraint: "on" }
D --> G@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Validate TLS", pos: "b", h: 96, constraint: "on" }
E --> G
F1 --> G
G --> H@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Notify Chatroom", pos: "b", h: 96, constraint: "on" }
classDef noBorder fill:transparent,stroke:transparent
class A,B,C,D,E,F,F1,G,H noBorder
Switch routing
| Risk tier | Action |
|---|---|
Low |
Auto-renew |
Medium |
Notify + renew |
High |
Approval required |
Playbooks
| Playbook | What it does | Runs on |
|---|---|---|
assess_risk.yml
|
Prepares AI agent risk assessment output into set_stats artifacts for the AO switch. | RHEL node |
auto_renew.yml
|
Auto-renews a low-risk certificate with a self-signed cert for demo purposes. | RHEL node |
notify_renew.yml
|
Notifies operators about medium-risk renewal, then proceeds with renewal. | RHEL node |
validate_tls.yml
|
Validates TLS certificate file and expiry after renewal. | RHEL node |
notify_chatroom.yml
|
Posts risk-based routing results to Mattermost. | localhost (Mattermost API) |
AI Generated
This demo's playbooks and workflow were generated by AI to illustrate the pattern. They have not been fully tested in a live environment. Review and adapt before using in production.