SOMETHING ASKS. PEOPLE PRESS. THEN IT RUNS.
A hardware approval step for anything your pipeline shouldn't do on its own.
EXAMPLE
GITHUB ACTIONS
Same three steps for a Slack command, a webhook, or your own service.
01
SOMETHING ASKS
A deploy job pauses at the production gate. One line of YAML, no Outis secret in the repo.
deploy:
environment: production
steps: ...
02
PEOPLE PRESS
Each approver gets a code, turns a key, checks the payload on the box, and presses.
CY-01STAGED 1/2
PAYLOAD
DEPLOY · PRODUCTION
4f2a9c1
WAIT maya
03
THEN IT RUNS
Outis answers GitHub. Approved and the run continues. Abort or expiry and it fails closed.
APPROVEDThe run ships.
REJECTEDNothing ran.
ONE KEY OR FIVE. WHENEVER OR ALL AT ONCE.
You set the rule per action. Most of them never need a meeting.
GITHUB.MERGE-OWN-PR
1 OF 1
KEYS · ELIGIBLE
WHENEVER
COUNTED · SELF-APPROVAL OK
Your own PR, checks green. One key, no ceremony.
dana
PRESSED
dana 14:02
REQUESTED
EXPIRES · 30M
GITHUB.APPROVE-PR
1 OF 3
KEYS · ELIGIBLE
WHENEVER
COUNTED · NOT THE AUTHOR
Anyone but the author, whenever they get to it.
dana
CAN'T
keith
PRESSED
maya
NOT NEEDED
sam
NOT NEEDED
keith 11:47
REQUESTED
EXPIRES · 4H
SECRETS.ROTATE-SIGNING-KEY
2 OF 4
KEYS · ELIGIBLE
WHENEVER
COUNTED · EACH ON THEIR OWN TIME
Two sign-offs over an afternoon. Nobody books a meeting.
keith
PRESSED
maya
NOT NEEDED
sam
PRESSED
ana
NOT NEEDED
keith 10:12
sam 13:40
REQUESTED
EXPIRES · 4H
DEPLOY.PRODUCTION
2 OF 2
KEYS · ELIGIBLE
ALL AT ONCE
COINCIDENT · ONE SHARED WINDOW
For the incident call. Nobody commits alone.
dana
CAN'T
keith
PRESSED
maya
PRESSED
20S WINDOW
keith, maya 14:05
REQUESTED
EXPIRES · 30M
ASKS FROM
CODES VIA
KEEPS
Every press, in an append-only log.