Documentation menu
Overview
Getting started
Platform
Partners
Security
Docs / Platform
Governed response
Every kymeer response action has a danger level. Destructive actions run only after a second person approves, and playbooks can be dry-run first.
Every response action in kymeer carries a danger level. Destructive actions run only after a second person approves them, and any playbook run can be a dry run first.
What are the danger levels?
| Level | What it means | Default for |
|---|---|---|
| Safe | No external side effect. Runs straight away, with a role check and an audit record. | Notifications, reports, enrichment |
| Sensitive | Has side effects, but scoped or reversible. Approval can be required per action. | HTTP requests, connector actions |
| Destructive | Irreversible or wide-reaching. Always needs approval, and runs only through the background executor, never directly from a request. | Scripts, containment |
A level can be raised for a specific action, never quietly lowered.
Who approves a destructive action?
The person who starts the run is the maker. The approver must be a different user, and the database refuses an approval by the maker. Each approval or rejection is written to the audit log.
Can I test a playbook first?
Yes. Any run can be started as a dry run, which validates and plans each step but takes no action, so the team can see what it would do.
How are playbooks started?
A person starts each run, either from the playbook or as a one-click action from an incident or case. For each step you choose what happens if it fails: stop the run, carry on, or run the step's recorded rollback.
Can AI write a playbook?
The AI analyst can draft one from a prompt. The draft is never saved automatically: it opens in the designer, steps that name an unknown action are dropped, and a person reviews and saves it. See AI analyst.
How is response activity traced?
The audit log can be searched by actor, action, outcome, resource and time. Results are always limited to your own tenant.