The following trials are running in shadow mode, capturing what each executor would do before being armed. Review the evidence here; arm a trial when you are satisfied it is correct.

Every automated action in belton-os is a proposal. No engine, agent, or rule writes to Autotask or any external system without an explicit human approval. The flow is always:

1. Proposed — an engine or agent detects a condition and raises a proposal with evidence, rationale, and a proposed action.
2. Approved — an approver or admin reviews the proposal and clicks Approve. Rejected proposals are audited and closed.
3. Executing — the executor runs the action (e.g. create a ticket, update a contract line, send a communication). If write credentials are absent or the kill switch is ON, the executor simulates and logs "SIMULATED".
4. Executed / Failed — the final state. Every transition is written to the immutable audit log with actor, timestamp, and outcome.

This is the moat: agents can act continuously without becoming a liability. Nothing is autonomous — everything is traceable.

• Kill switch — per-tenant master stop. When ON, no rules fire, no proposals execute, and executors simulate. Use "Stop automation + clear pending" to turn it ON, revert all live rules, and reject open proposals in one click.
• Entity freeze — a specific client or ticket can be frozen so no automation touches it while an operator is working it manually.
• Hourly rate breaker — hard cap of 100 proposals per hour per tenant. Trips automatically and logs a RATE_BREAKER audit event.
• Dry-run / shadow mode — rules in dry_run mode fire, evaluate, and log — but do not raise proposals. Safe to run without risk.
• Autoexecute entitlement — proposals only auto-execute when the tenant holds the automation.autoexecute entitlement AND write-scoped Autotask credentials are configured AND the "Automation Complete" ticket status exists in Autotask.
• RLS tenant isolation — every DB query runs as belton_app (no bypass); row-level security enforces that no tenant sees another's data.

1. Confirm connectors — go to the Connectors tab, ensure Autotask, Datto RMM, and Pax8 are wired. Without connectors, engines have no data.
2. Run the fleet in dry_run — click "Run fleet" on the Automation tab. All rules are in dry_run by default; proposals are raised but nothing executes.
3. Review proposals — go to the Activity tab. Review each proposal's evidence and rationale. Approve or reject.
4. Promote rules to live — once you are satisfied that rules are accurate, use "Promote proven → live" to move the proven AutoStatus-faithful rules from dry_run to live. Live rules raise proposals that are subject to autoexecute when armed.
5. Arm autoexecute (admin only) — this requires three conditions to be true (see checklist below): the autoexecute entitlement granted, Autotask write credentials configured, and the "Automation Complete" picklist status created in Autotask. Contact your platform admin to grant the entitlement.
6. Monitor — the Platform landing page shows the live state: banner, counters, agent runs, and recent proposals. The Audit Log tab has the immutable trail.

The KPI is computed from the audit trail: sum(minutes_saved) where status='executed' divided by the performance_baselines table (total staff minutes per period). This is the only honest measure — proposals that are raised but never approved score zero. The KPI cannot be gamed by building agents that do not get approved.

Target: 30% reduction in manual time. Current progress is shown on the Automation KPI card.

To arm autoexecute: contact your platform admin to grant the automation.autoexecute entitlement, configure Autotask write credentials in Connectors, and verify the "Automation Complete" ticket status exists in Autotask.