{
  "format": "minctrl.process/v1",
  "graph": {
    "edges": [
      {
        "id": "e0___start____intake",
        "source": "__start__",
        "target": "intake"
      },
      {
        "id": "e1_intake__plan",
        "source": "intake",
        "target": "plan"
      },
      {
        "id": "e2_plan__split",
        "source": "plan",
        "target": "split"
      },
      {
        "id": "e3_split__classify",
        "source": "split",
        "target": "classify"
      },
      {
        "id": "e4_split__access",
        "source": "split",
        "target": "access"
      },
      {
        "id": "e5_classify__merge",
        "source": "classify",
        "target": "merge"
      },
      {
        "id": "e6_access__merge",
        "source": "access",
        "target": "merge"
      },
      {
        "id": "e7_merge__autocanary",
        "label": "routine single-tenant change",
        "source": "merge",
        "target": "autocanary"
      },
      {
        "id": "e8_merge__changeapproval",
        "label": "fleet-wide / privileged / destructive change",
        "source": "merge",
        "target": "changeapproval"
      },
      {
        "id": "e9_changeapproval__gatedcanary",
        "source": "changeapproval",
        "target": "gatedcanary"
      },
      {
        "id": "e10_autocanary__health",
        "source": "autocanary",
        "target": "health"
      },
      {
        "id": "e11_gatedcanary__health",
        "source": "gatedcanary",
        "target": "health"
      },
      {
        "id": "e12_health__plan",
        "label": "regression — roll back and replan",
        "source": "health",
        "target": "plan"
      },
      {
        "id": "e13_health__rolloutsignoff",
        "label": "canary healthy",
        "source": "health",
        "target": "rolloutsignoff"
      },
      {
        "id": "e14_rolloutsignoff__widen",
        "source": "rolloutsignoff",
        "target": "widen"
      },
      {
        "id": "e15_widen__monitor",
        "source": "widen",
        "target": "monitor"
      },
      {
        "id": "e16_monitor____end__",
        "source": "monitor",
        "target": "__end__"
      }
    ],
    "nodes": [
      {
        "agent": null,
        "confidential": false,
        "gate": null,
        "gateway": null,
        "human": null,
        "id": "__start__",
        "interrupt_before": false,
        "kind": "terminal",
        "label": "Start",
        "position": {
          "x": 0,
          "y": 0
        },
        "reversible": true,
        "sla": null,
        "sla_spec": null,
        "tier": "terminal",
        "tools": []
      },
      {
        "agent": "intake",
        "confidential": false,
        "gate": null,
        "gateway": null,
        "human": null,
        "id": "intake",
        "interrupt_before": false,
        "kind": "agent",
        "label": "Detect the change needed (patch / config / remediation), pull tenant + fleet context and take a pre-change snapshot",
        "position": {
          "x": 0,
          "y": 120
        },
        "reversible": true,
        "sla": null,
        "sla_spec": null,
        "tier": "low",
        "tools": [
          "monitoring",
          "patch-source",
          "backup-dr"
        ]
      },
      {
        "agent": "planner",
        "confidential": false,
        "gate": null,
        "gateway": null,
        "human": null,
        "id": "plan",
        "interrupt_before": false,
        "kind": "agent",
        "label": "Plan a staged ring rollout (canary -> rings) with health gates and a tested rollback, scoped to one tenant",
        "position": {
          "x": 0,
          "y": 240
        },
        "reversible": true,
        "sla": null,
        "sla_spec": null,
        "tier": "low",
        "tools": [
          "rmm"
        ]
      },
      {
        "agent": null,
        "confidential": false,
        "gate": null,
        "gateway": "parallel",
        "human": null,
        "id": "split",
        "interrupt_before": false,
        "kind": "gateway",
        "label": "Run the pre-flight checks concurrently",
        "position": {
          "x": 0,
          "y": 360
        },
        "reversible": true,
        "sla": null,
        "sla_spec": null,
        "tier": "gateway",
        "tools": []
      },
      {
        "agent": "compliance",
        "confidential": false,
        "gate": null,
        "gateway": null,
        "human": null,
        "id": "classify",
        "interrupt_before": false,
        "kind": "agent",
        "label": "Classify blast radius and change type (fleet-wide / privileged / destructive vs single-tenant routine) against SOC 2 controls",
        "position": {
          "x": 0,
          "y": 480
        },
        "reversible": true,
        "sla": null,
        "sla_spec": null,
        "tier": "low",
        "tools": [
          "rmm",
          "monitoring"
        ]
      },
      {
        "agent": "compliance",
        "confidential": false,
        "gate": null,
        "gateway": null,
        "human": null,
        "id": "access",
        "interrupt_before": false,
        "kind": "agent",
        "label": "Verify JIT least-privilege grant and tenant isolation hold for the planned change",
        "position": {
          "x": 0,
          "y": 600
        },
        "reversible": true,
        "sla": null,
        "sla_spec": null,
        "tier": "low",
        "tools": [
          "idp"
        ]
      },
      {
        "agent": null,
        "confidential": false,
        "gate": null,
        "gateway": "exclusive",
        "human": null,
        "id": "merge",
        "interrupt_before": false,
        "kind": "gateway",
        "label": "Join checks; route on blast radius",
        "position": {
          "x": 0,
          "y": 720
        },
        "reversible": true,
        "sla": null,
        "sla_spec": null,
        "tier": "gateway",
        "tools": []
      },
      {
        "agent": "operator",
        "confidential": false,
        "gate": null,
        "gateway": null,
        "human": null,
        "id": "autocanary",
        "interrupt_before": false,
        "kind": "agent",
        "label": "Routine single-tenant change: auto-apply to the canary ring under the health gate with auto-rollback armed — a reversible, in-policy change",
        "position": {
          "x": 0,
          "y": 840
        },
        "reversible": true,
        "sla": null,
        "sla_spec": null,
        "tier": "medium",
        "tools": [
          "rmm"
        ]
      },
      {
        "agent": null,
        "confidential": false,
        "gate": "gate:change-approval",
        "gateway": null,
        "human": "MSP engineer / change manager",
        "id": "changeapproval",
        "interrupt_before": true,
        "kind": "gate",
        "label": "Change manager approves the fleet-wide / privileged / destructive change before it touches any device",
        "position": {
          "x": 0,
          "y": 960
        },
        "reversible": false,
        "sla": null,
        "sla_spec": null,
        "tier": "high",
        "tools": []
      },
      {
        "agent": "operator",
        "confidential": false,
        "gate": null,
        "gateway": null,
        "human": null,
        "id": "gatedcanary",
        "interrupt_before": false,
        "kind": "agent",
        "label": "Apply the approved high-blast-radius change to the canary ring with a health gate; auto-halt on regression",
        "position": {
          "x": 0,
          "y": 1080
        },
        "reversible": false,
        "sla": null,
        "sla_spec": null,
        "tier": "high",
        "tools": [
          "rmm",
          "idp"
        ]
      },
      {
        "agent": null,
        "confidential": false,
        "gate": null,
        "gateway": "exclusive",
        "human": null,
        "id": "health",
        "interrupt_before": false,
        "kind": "gateway",
        "label": "Canary healthy?",
        "position": {
          "x": 0,
          "y": 1200
        },
        "reversible": true,
        "sla": null,
        "sla_spec": null,
        "tier": "gateway",
        "tools": []
      },
      {
        "agent": null,
        "confidential": false,
        "gate": "gate:fleet-rollout-signoff",
        "gateway": null,
        "human": "MSP engineer / change manager",
        "id": "rolloutsignoff",
        "interrupt_before": true,
        "kind": "gate",
        "label": "Change manager signs off the fleet-wide widen after reviewing canary health metrics",
        "position": {
          "x": 0,
          "y": 1320
        },
        "reversible": false,
        "sla": null,
        "sla_spec": null,
        "tier": "high",
        "tools": []
      },
      {
        "agent": "operator",
        "confidential": false,
        "gate": null,
        "gateway": null,
        "human": null,
        "id": "widen",
        "interrupt_before": false,
        "kind": "agent",
        "label": "Widen the rollout fleet-wide across the remaining rings",
        "position": {
          "x": 0,
          "y": 1440
        },
        "reversible": false,
        "sla": null,
        "sla_spec": null,
        "tier": "high",
        "tools": [
          "rmm",
          "idp"
        ]
      },
      {
        "agent": "monitor",
        "confidential": false,
        "gate": null,
        "gateway": null,
        "human": null,
        "id": "monitor",
        "interrupt_before": false,
        "kind": "agent",
        "label": "Verify post-change health, revoke JIT access, and log every action for the SOC 2 audit trail",
        "position": {
          "x": 0,
          "y": 1560
        },
        "reversible": true,
        "sla": null,
        "sla_spec": null,
        "tier": "low",
        "tools": [
          "monitoring",
          "psa-ticketing"
        ]
      },
      {
        "agent": null,
        "confidential": false,
        "gate": null,
        "gateway": null,
        "human": null,
        "id": "__end__",
        "interrupt_before": false,
        "kind": "terminal",
        "label": "Done",
        "position": {
          "x": 0,
          "y": 1680
        },
        "reversible": true,
        "sla": null,
        "sla_spec": null,
        "tier": "terminal",
        "tools": []
      }
    ]
  },
  "hash": "97ade22e610181921ca495f5d2da55b4836ce3a26a2887af8a03691e9ce6638c",
  "name": "Managed-IT autopilot",
  "slug": "msp",
  "source": "example",
  "version": null,
  "violations": []
}