Workflows, jobs, and script execution

Prerequisites

• Role with jobs.view / jobs.manage for job operations
• Role with scripts.view / scripts.manage for script operations
• Role with workflows.view / workflows.manage for workflow operations
• For PAM-integrated workflows: pam_vaults.view / pam_vaults.manage and configured identities
• Target hosts must be online with active agents

Creating scripts

1. Navigate to Scripts > Create Script
2. Enter a descriptive name
3. Select the language: PowerShell, Bash, or Python
4. Write or paste the script content
5. Set the timeout (maximum execution time in seconds, default: 300)
6. Define input parameters (name, type, required flag, default value)
7. Optionally set a Run-as Identity for privileged execution via PAM
8. Toggle Requires Elevation if the script needs sudo/admin
9. Click Save

Script libraries

Create reusable function libraries at Scripts > Libraries. Link a library to a script and its content is automatically prepended to the script before execution. Use libraries for shared utility functions across multiple scripts.

Executing a script

1. On the script detail page, click Execute
2. Select target host(s)
3. Fill in any required parameters
4. Click Run -- the system creates one job per host

Viewing results

Navigate to Scripts > [Script] > Executions. Each execution shows the host name, exit code, stdout/stderr output, duration, and success/failure status.

Running ad-hoc jobs

Jobs are the fundamental execution unit. Every agent operation -- scripts, commands, service control, patching -- is backed by a Job record.

Job types

Job lifecycle

Status flow

Job actions

Timeouts

• Running jobs: timed out if elapsed time exceeds 2x the payload timeout
• Stale queued jobs: auto-failed after 30 minutes past the scheduled time with "Agent did not pick up job" message

Creating workflow definitions

Workflows chain multiple steps into repeatable automation sequences with branching, approval gates, and credential management.

1. Navigate to Workflows > Create Workflow
2. Enter a name and description
3. Add steps using the visual editor
4. Configure each step's success and failure routing
5. Click Save

Available step types

Step configuration

Each step has the following properties:

Script step example

{
  "id": "health_check",
  "type": "script",
  "name": "Run health check",
  "script_id": 42,
  "parameters": {"threshold": "90"},
  "on_success": "deploy_step",
  "on_failure": "notify_failure"
}

Approval step example

{
  "id": "approve_deploy",
  "type": "approval",
  "title": "Approve production deployment",
  "approval_type": "one_of_many",
  "approvers": ["role:admin", "user:5"],
  "timeout_minutes": 60,
  "on_success": "deploy_step",
  "on_failure": "cancelled"
}

Variable substitution

Use {{path.to.value}} syntax in script parameters, command strings, approval titles, and checkout reasons to reference data from previous steps.

Step result variables

Auto-created when a script or command step completes successfully:

PAM credential variables

Auto-created on PAM checkout. Variables are stored under both the explicit variable_name from step config and the identity's name.

Conditional expressions

Conditionals can reference any variable:

{
  "id": "check_result",
  "type": "conditional",
  "config": {
    "condition": "{{step_scan.exit_code}} == 0",
    "on_true": "continue",
    "on_false": "rollback"
  }
}

Legacy syntax

The variables. prefix also works for backward compatibility: {{variables.step_scan.stdout}}, {{variables.db_admin.username}}.

Approval workflows

Approval steps pause the workflow and wait for human authorization. Pending approvals appear in Workflows > Approvals.

Approval types

Each approval request has an optional timeout (in minutes). If nobody responds before the deadline, the approval auto-rejects and routes to the failure path.

Running workflow instances

1. Navigate to the workflow definition
2. Click Start
3. Select target hosts
4. The system creates a workflow instance and begins processing steps

Instance statuses

On the instance detail page, monitor the current step, view completed step results, and respond to pending approval requests.

PAM integration in workflows

Use pam_checkout and pam_checkin steps to integrate privileged credential management directly into your workflows.

Checkout step

• Creates a privileged session for the specified identity
• If the identity requires approval, the workflow pauses until approved
• Credential data is stored in the workflow instance for use by subsequent steps
• Use run_as: "{{identity_name}}" on script/command steps to execute with the checked-out credential

Checkin step

• Ends the privileged session(s) created by the checkout step
• If the identity has "Rotate After Use" enabled, triggers automatic password rotation

Recurring jobs

Schedule jobs to repeat automatically using cron expressions.

1. Create a job (script, command, etc.) as usual
2. Toggle Recurring
3. Enter a Cron Expression (standard 5-field syntax, e.g., 0 2 * * * for daily at 2 AM)
4. Optionally set Max Recurrences (total execution limit)
5. Optionally set an End Date
6. Click Save

The scheduler creates child jobs at each cron tick. View execution history via the parent job's children. The template job tracks the next run time and recurrence count, and stops when limits are reached.

Permissions reference

Workflow execution lifecycle

Troubleshooting