We run every automation in the dark before it touches you

Honestly, a crash is the automation failure I worry about least. It's loud, you catch it, you fix it, you move on. The one that keeps me up is the automation that works exactly like it's supposed to, on the wrong customer. A workflow that fires a confirmation off to the wrong client doesn't feel like a bug when it happens. It feels like somebody screwed up, except nobody did, and by the time you catch it, it's already done that a hundred times.

So we build on a rule that probably sounds a little paranoid, and that's kind of the point. An automation doesn't get to touch your customers just because we shipped it. It has to earn that first.

Everything runs in the dark first

Every workflow we build starts in what we call shadow mode. It runs against your real data, on the real schedule, making real decisions. It figures out the exact email it would send, right down to who it goes to and what it says. Then it stops one step short of the only step that actually reaches a person, and it doesn't send. It just writes down what it would have done, and we go read that back.

This is the part most automation skips. Plenty of tools have a test mode, and sure, it tells you the code runs. But it's running on fake data in a sandbox, so it can't tell you what the thing will actually do to your real customers, on your real and kind of messy data, in the weird edge cases your business throws at it every week. Shadow mode does tell you that, because it's the real automation with the last move held back.

It's the real automation, doing the real job, with the one wire that reaches a customer clipped.

Nothing goes live on its own

An automation only leaves shadow mode when two things line up. It's built up a track record of shadow runs that did real, correct work. And a person flips the switch for that one automation, on that one client's account. There's no global on button, nothing that flips the whole thing live at once. It's earned, one automation at a time, and it's a call somebody makes on purpose after actually looking at what the shadow runs did.

So there's a human in the loop, but only where it actually matters. The routine, in-bounds stuff never stops to ask you anything, it just runs. The one moment that carries real risk, going live, is the one moment a person has to sign off. That's kind of the whole balance we're going for.

The guardrails that let us sleep

A rule is only as good as whatever's enforcing it. And what makes this one hold up under pressure is that it's built into the wiring. It doesn't depend on us remembering anything. Every outbound action, anything that could actually reach a customer, has to go through one single door. A contained run physically can't get out that door, even if one of us forgets a check somewhere, because the door itself won't let it through. The safety is in the plumbing. It doesn't ride on us having a good day.

A couple more things keep it honest. A run decides whether it's live or shadow once, right at the start, and it holds that the whole way through, so if someone flips the switch mid-run, nothing tears in half; the change just applies to the next run. And here's the one I like most: if we ever change the code behind a live automation, it drops itself back to shadow and has to earn its way to production all over again. New code hasn't proven anything yet, so it doesn't get to inherit the trust the old code built up.

Why we bother

None of this is glamorous, honestly. Shadow mode is boring to watch, and that's kind of the whole point. But it's the difference between an automation you hope works and one you've actually watched work, on your data, before it ever got near a customer. So by the time we hand you a system, it's already done its whole probation in the dark. You find out it works because it's been working the entire time. And the version where it breaks? You never see that one, because we already did, first, somewhere it couldn't cost you a thing.