Who this is for: Builders transferring a workflow and operators taking responsibility for it.
A workflow export tells someone how the build is configured. It doesn't tell them whether yesterday's invoices completed or whether replaying a failed run will charge a customer twice.
A handoff is complete when the receiving operator can diagnose a known failure, decide whether replay is safe, and show that the resulting records reconcile. Use the runbook template to make that exercise repeatable.
Start with ownership and business impact
Name a primary operator, a backup, and the business owner who can authorize a pause or a consequential correction. Use a maintained team route where possible so an alert doesn't depend on one person's employment or holiday calendar.
Describe the workflow's trigger, accepted output, systems, and consequence of delay. List credential owners and where access is managed. Link to the approved secret store; never put passwords or tokens in the runbook.
| Item | What to record |
|---|---|
| Workflow | Purpose, trigger, accepted output |
| Operator | Primary route and backup |
| Business owner | Who can approve a pause or correction |
| Dependencies | Apps, fields, webhooks, schedules, versions |
| Access | Credential owner and approved access process |
| Evidence | Execution references and reconciliation location |
Make alerts answer the next question
An alert should identify the workflow, affected record, failure stage, and what the operator should inspect. Separate temporary delivery failures from data that needs correction. Retrying invalid input without changing it just creates noise.
Monitor for absence as well as explicit failure. If eligible deals exist but no handoffs appear, the trigger may have stopped before an execution was recorded. Reconcile expected inputs to completed outputs and outstanding exceptions.
Document safe recovery in order
Illustrative failure: project creation completed, but saving its ID to the CRM timed out. Pause the relevant event if needed, inspect the destination using the source deal ID, and record whether the project already exists. Only retry the missing step once that state is known.
Don't describe rollback as a universal undo button. An email already sent or a payment already accepted may need a compensating business action. Record who approves that action and how it will be reconciled.
- Step 1
Contain
Pause the affected scope if further writes could worsen the error.
- Step 2
Inspect
Check source, destination, and execution evidence by persistent ID.
- Step 3
Resolve
Correct input or access; determine what already completed.
- Step 4
Recover
Replay only the safe missing step or obtain approval for correction.
- Step 5
Reconcile
Verify the final business state and close the exception.
Practice the handoff and schedule maintenance
Give the receiving operator a synthetic failed case and the runbook. Let them handle it without live coaching. Record gaps, update the procedure, and repeat the parts that were unclear.
Schedule checks around actual dependencies: credential expiry, vendor changes, queue age, failed-run trends, and restore tests where infrastructure is owned. Record the last completed check and the next owner. A calendar entry alone isn't evidence that a backup can be restored.
- The backup operator can access required evidence.
- A duplicate event was replayed without a duplicate output.
- The stop procedure was exercised in a safe environment.
- Alert ownership and escalation were demonstrated.
- The receiving owner accepted the handoff.
Free download · No email required
Automation operating runbook
Complete before handoff. Keep credentials in the approved secret store, not this document. Practice recovery with synthetic records and record evidence.
Open the CSV in Excel, Google Sheets, or another spreadsheet tool. The Markdown brief is editable in a text editor.
Common questions
- Can one runbook cover several workflows?
- Share the common operating procedures, but keep workflow-specific ownership, identifiers, side effects, and recovery cases explicit. A generic retry instruction isn't enough.
