Appearance
Runbook Safety & Controls
Runbooks let the agent do real work in your PSA, RMM, and other connected systems. This page explains precisely when a runbook runs, what it can touch, and which switches control that, so you can decide how much autonomy to give each procedure.
The Short Version
- A runbook never starts on its own unless you publish it, turn on auto-run for that specific runbook, and the agent matches it to a ticket with high confidence.
- Auto-run does not make a runbook run on every ticket. It only removes the Approve & Execute click on tickets the agent has already matched to that runbook. An informational card still posts so the team can see what started.
- With auto-run off, a matched runbook is a recommendation card in Slack or Teams and in the ticket. Nothing happens until someone approves it.
- Every run is scoped to one company, uses only that company's integrations, runs only the published version, and is recorded in execution history.
- Tool policies still apply inside a run. High-risk tools need explicit sign-off before they can run unattended, and escalation-tier tools always wait for a person.
How a Runbook Gets Started
| Trigger | Who decides | Where auto-run applies |
|---|---|---|
| Run now | A technician clicks it on the runbook page | No |
| Schedule | Fires at the time you configured, for the companies you chose | No |
| Incoming webhook | An event from another system matches a trigger you attached | No |
| Triage match | The agent matches a new ticket to the runbook | Yes, this is the only path auto-run affects |
Only published runbooks can run. Draft and archived runbooks are never matched or executed, and every run uses the published version's content, so edits in progress never affect a live run.
What "Matched Ticket" Means
When a new ticket is triaged, the agent compares it against your published runbooks (global ones plus any scoped to the ticket's company), using each runbook's content and its attached example tickets. If it finds a fit, it creates a runbook recommendation with a confidence score. The auto-run decision happens only at that point, for that one runbook, on that one ticket.
If no runbook matches, nothing is recommended and nothing runs. The agent does not pick a runbook for a ticket it does not fit, and auto-run cannot change that.
The Organization Switches
Two switches under Settings > Processors > Triage approvals govern every runbook in your organization:
| Switch | What it does |
|---|---|
| Runbook Recommendations | After triage, the agent looks for matching runbooks and posts recommendation cards. With this off, no runbooks are recommended and no runbook auto-runs, even if individual runbooks have auto-run turned on. |
| Auto-run recommended runbooks | The master switch for unattended runs. When on, runbooks that have their own auto-run setting enabled execute without approval once confidence meets their threshold. Requires Runbook Recommendations. With this off, every match is a card. |
Turning either switch off takes effect immediately for new matches. A runbook that is already executing keeps going until it finishes or someone stops it from the ticket chat.
Auto-Run Off vs. On
Auto-run is set per runbook in the editor (see Auto-Run). Here is what changes on a matched ticket and what does not:
| Auto-run off (default) | Auto-run on | |
|---|---|---|
| Matched ticket | A recommendation card posts to Slack or Teams and the ticket chat. The runbook starts only when someone clicks Approve & Execute. | The runbook starts immediately if the match confidence is at or above the runbook's Min confidence, and an informational card (no buttons) posts to the same channel so the team can see it is running. Below the threshold, the normal card posts instead. |
| Unmatched ticket | Nothing | Nothing |
| Who the run is attributed to | The person who approved it | The Runs unattended as technician |
| Tools referenced in the steps | Run without further prompts once the run is approved | Run without prompts |
| High-risk tools in the steps | Ask for approval before they run, according to each tool's approval setting | Run unattended only if they were acknowledged when auto-run was enabled; otherwise the run pauses at that step |
| Escalation-tier tools | Wait for an approver | Wait for an approver (the run pauses) |
| Tools the steps do not reference | Follow their normal tool policy | Follow their normal tool policy; an approval prompt pauses the run |
Turning auto-run off for a runbook returns it to the card-based flow on the next match. Runs already in progress are not stopped.
Where Recommendations Go
When auto-run is off, the confidence is below threshold, or a safeguard blocks the unattended launch, the match becomes a recommendation:
- Slack or Teams -- A card with Approve & Execute and Deny buttons posts to the channel routed to the Runbook Approvals slot (see Notification Channels). That post becomes the ticket's thread, so later approval cards and agent progress for the run land under it. Responding requires a linked Slack or Teams account, the Operator role or higher, and access to the ticket's company.
- Ticket chat in the web app -- The same card appears in the ticket's conversation as an Action Request.
A recommendation expires after 24 hours, or sooner if the ticket is resolved or closed. If no channel is routed to Runbook Approvals, cards do not post to Slack or Teams but remain visible in the Junto app.
Safeguards That Always Apply
These hold for every run, whether supervised or unattended:
- Published version only. Draft edits never reach a live run.
- One company per run. A run is scoped to a single company and can only use integrations mapped to that company. A global runbook run with All Companies on a schedule becomes one separate execution per company, each with its own scope.
- Tool policies are the ceiling. A tool an admin has switched off is denied inside a runbook, even if the steps reference it.
- High-risk tools are acknowledged one by one. When you enable auto-run, Junto lists every high-risk tool the runbook uses and asks you to approve each for unattended use. Acknowledgment is per tool name: if the runbook is later edited to use a new high-risk tool, that tool is not covered. The run pauses at that step until a person approves it, and the editor warns you to review the list the next time you save.
- Escalation-tier tools are never automated. Tools that require a higher role to approve always wait for that approver, auto-run or not.
- A named technician is required. Auto-run cannot be enabled without choosing who the run is attributed to. If that user is later removed from the organization, auto-run fails closed and the team gets the normal card instead of an unattributed run.
- No self-triggering loops. A runbook can create a PSA ticket as part of its work. When that ticket syncs back and is triaged, no runbook auto-runs on it. The team gets a card with the reason.
- Confidence threshold. Each auto-run runbook has its own Min confidence (50--99%, default 75%). Matches below it are recommended, not executed.
- Everything is recorded. Every run appears in Executions & Monitoring with its status, outcome, inputs, and linked ticket. Milestones and approvals are written to the ticket chat. Changes to auto-run and tool policies are captured in the audit log.
- You can stop a run at any time from the active runbooks panel in the ticket chat.
Require a Completion Ticket
Every runbook has a Require a completion ticket switch in the editor, next to the Auto-run switch. It is on by default.
| Setting | Behavior |
|---|---|
| On (default) | Every execution files a ticket in your PSA with the results and logs its time entry there. Run now and schedules ask for a ticket category (board or queue), and the run must target a company that is synced with your PSA. If a run finishes without filing a ticket, its outcome is flagged Completed without creating a ticket so you can follow up. |
| Off | The run reports its results to the execution record only. Run now skips the ticket category and lists every company, including ones not synced with your PSA. Schedules still ask for a board or queue, but a ticketless run does not file a ticket there. |
When a runbook starts from a triage match, it works the ticket that matched it. The completion ticket applies to runs that do not start from an existing ticket, such as Run now, scheduled runs, and audit responses.
Turn it off for internal checks, reporting, or procedures that update systems other than your PSA, where a ticket per run is noise. Leave it on for client-facing work that should be billable and visible in the PSA.
To change it:
- Open the runbook and click Edit.
- Flip Require a completion ticket in the header bar.
- Click Save changes.
The change applies to the next execution. Runs already in progress are not affected.
A Safe Rollout
- Publish and run supervised. Leave auto-run off. Watch the runbook run from recommendation cards, approving each launch with Approve & Execute.
- Review its track record. Open Runs on the runbook and check outcomes. Fix the steps if you see partial successes or failures.
- Enable auto-run with a high threshold. Set Min confidence toward Fewer, safer, pick the technician the run is attributed to, and review the high-risk tool list before confirming.
- Lower the threshold as trust builds. Each successful run attaches its ticket as an example, so matching gets more accurate over time.
Asking the Agent
In Explore, you can ask questions like "What happens if I turn on auto-run?", "Does auto-run mean this runbook runs on every ticket?", or "What does Require a completion ticket do?" The agent answers from this documentation.