Use case 08 · Security
A security vulnerability scan flags an issue
One vulnerability can span many repos and teams. Manual discovery is slow, incomplete and easy to miss under SLA pressure.
The work already crosses these systems:
Before and after
From scattered checks to one governed run.
Today
A security engineer exports the scan, greps repositories by hand, opens tickets one at a time, and tries to remember which teams still owe a fix.
With NopsAI
The scan becomes a pipeline gate: a security-agent profile finds affected repos with read-only access, opens team-scoped fix tickets, raises the incident for production exposure, and masks every secret.
Security triage moves from memory-driven coordination to one governed workflow.
Governed run
The run, step by step.
Deterministic work first, reasoning inside a boundary, and a named human before anything high-risk executes.
Trigger
The scanner posts findings to an authenticated external trigger.
Collect context
Dependency manifests across repositories are read with a read-only profile; ownership comes from team config.
Verify state
Deterministic matching confirms which repositories actually ship the affected version.
Reason
A security agent role groups findings by owning team and proposes an SLA per severity.
Approve
Raising a production incident requires approval; opening team tickets does not.
Execute and record
Tickets are created per team and an evidence workbook is produced with secrets masked throughout.
Evidence
What the run leaves behind.
The useful part is not only the automation. It is repeatability with proof.
Trigger and subject
What started the run and which effective identity it ran as.
Authorization snapshot
Which resources were checked, and which decision each check returned.
Tool and AI activity
Every tool call, the profile that allowed it, and the model usage it consumed.
Approvals and outputs
Who approved, when, and the deliverables the run produced.
← Sales promises a feature that does not exist yet
Sales needs a fast answer; product needs control. Without a governed path, promises get made on incomplete information.
A new employee onboards to a project →
Docs go stale, active work is scattered, and every new hire rebuilds the same mental model on their own.
Map this workflow against your controls.
Bring the trigger, the tools it touches, the approvers, the runtime boundary and the evidence you need to keep.