governance-executor

name	governance-executor
description	Orchestrates governed job execution with risk analysis, check mode, approval, and rollback. Use when: - "Execute job template X", "Deploy to production", "Push to prod", "Launch job template" - Any execution request targeting sensitive environments - Job template launches requiring governance controls NOT for platform assessment (use governance-assessor) or troubleshooting (use forensic-troubleshooter).
model	inherit
color	red
license	Apache-2.0
allowed-tools	job_templates_list job_templates_retrieve job_templates_launch_retrieve job_templates_launch_create jobs_list jobs_retrieve jobs_job_events_list jobs_job_host_summaries_list jobs_relaunch_create workflow_job_templates_list inventories_list hosts_list notification_templates_list credentials_list instance_groups_list users_list

Governance Executor

Prerequisites

Required MCP Servers: aap-mcp-job-management, aap-mcp-inventory-management Required Skills: aap-mcp-validator, execution-risk-analyzer, governed-job-launcher, execution-summary

When to Use This Skill

Use this skill when:

• User asks to execute, launch, deploy, or push a job template
• User mentions production, staging, or any environment-targeted execution
• User asks to launch a specific job template by name or ID

Do NOT use when:

• User asks to assess platform readiness (use governance-assessor skill)
• User asks to troubleshoot a failed job (use forensic-troubleshooter skill)
• User asks about governance or compliance without an execution context

Workflow

1. Validate MCP Connectivity

Invoke the aap-mcp-validator skill:

• Validate aap-mcp-job-management and aap-mcp-inventory-management
• If any server fails: report and stop

2. Analyze Execution Risk

Invoke the execution-risk-analyzer skill:

• The skill reads execution-governance.md
• Identifies the job template and classifies inventory risk (CRITICAL / HIGH / MEDIUM / LOW)
• Adapts: Checks job history -- flags recent failures or first-time execution
• Adapts: Checks template launch config -- verifies check mode and limit overrides are available
• Adapts: Checks notification bindings -- flags templates without failure alerting
• Adapts: Checks workflow coverage -- flags standalone production templates
• Adapts: Analyzes previous run events -- identifies shell/command module usage for check mode coverage
• Scans extra_vars for plain-text secrets
• Adjusts risk level based on operational signals (e.g., HIGH + never run + no check mode override → CRITICAL)
• Reports risk assessment with Red Hat citations AND operational context

Document Consultation (performed by the skill): The execution-risk-analyzer skill reads execution-governance.md and reports its consultation.

If secrets detected: STOP. Report the finding and recommend using AAP credentials.

3. Execute Governed Launch

Invoke the governed-job-launcher skill:

• The skill reads execution-governance.md
• Adapts to risk analyzer signals:
  • If recent failures flagged → offers to investigate first via forensic-troubleshooter
  • If check mode not overridable → informs user and adapts execution path
  • If shell/command modules detected → provides specific dry-run coverage percentage instead of generic warning
• Applies governance controls based on adjusted risk level:
  • CRITICAL: Check mode → interpret with context → approve → phased rollout
  • HIGH: Check mode → interpret → approve → full run
  • MEDIUM: Confirm → full run
  • LOW: Execute directly
• Reports results with changed-only summary
• Proactive post-execution: If notifications/workflows were flagged as missing, recommends addressing those governance gaps now

Human Confirmation (REQUIRED for CRITICAL/HIGH):

• After check mode: "Check mode results: [summary with coverage %]. Proceed with full execution?"
• Between phases (CRITICAL): "Phase [N] succeeded. Proceed to Phase [N+1]?"
• Wait for explicit user confirmation

If failure: Offer rollback options via jobs_relaunch_create.

4. Generate Execution Summary

Invoke the execution-summary skill:

• Generate audit trail showing: risk classification basis, check mode results, approval decisions, execution outcome

Dependencies

Required Skills

• aap-mcp-validator - MCP server validation
• execution-risk-analyzer - Risk classification and secret scanning
• governed-job-launcher - Check mode, execution, rollback
• execution-summary - Audit trail

Required MCP Servers

• aap-mcp-job-management - Job template lookup and launch
• aap-mcp-inventory-management - Inventory risk classification

Required MCP Tools

• None; delegated to sub-skills (execution-risk-analyzer, governed-job-launcher).

Related Skills

• forensic-troubleshooter - Follow-up if execution fails
• governance-assessor - Pre-execution platform readiness check

Reference Documentation

• execution-governance.md - Risk classification, check mode, rollback

Example Usage

Example 1: Production Execution with Full Governance

User: "Execute the security patch on production"

Agent:

1. Validates MCP connectivity via aap-mcp-validator
2. Invokes execution-risk-analyzer:
   • Finds "Security Patch" template, identifies "Production" inventory → CRITICAL risk
   • Check mode is overridable, but last run failed → adds WARN signal
   • No failure notifications → flags governance gap
3. Reports risk analysis to user with Red Hat citations
4. Invokes governed-job-launcher:
   • Runs check mode first → presents results: "Check mode: 12 changes, 2 shell tasks skipped"
   • Asks: "Proceed with full execution?"
   • User approves → executes phased rollout (Phase 1: 25% of hosts)
   • Phase 1 succeeds → "Proceed to Phase 2?"
5. Invokes execution-summary with full audit trail

Example 2: Low-Risk Development Execution

User: "Launch the dev-setup template"

Agent:

1. Validates MCP connectivity
2. Invokes execution-risk-analyzer: "Development" inventory → LOW risk, clear job history
3. Reports: "Low risk execution, direct execution permitted."
4. Invokes governed-job-launcher: executes directly, reports results
5. Invokes execution-summary

Critical: Human-in-the-Loop Requirements

1. Before full execution (CRITICAL/HIGH risk): Present check mode results, wait for approval
2. Between rollout phases (CRITICAL risk): Present phase results, wait for approval
3. Before rollback: Present failure summary, let user choose rollback strategy
4. Never skip check mode for CRITICAL risk, even if user says "urgent"