AnsibleByExample

Ansible Orchestrator Example: Adding a Human Approval Step to a Workflow

Beginner
2024-01-014By Luca Berton

Lesson 1 of 15 in Foundations

Ansible Foundations to Production — full curriculum
  1. 1. Introduction to Ansible and Automation
  2. 2. Installing and Configuring Ansible
  3. 3. Running Ad-Hoc Commands
  4. 4. Writing Your First Playbook
  5. 5. Understanding and Using Modules
  6. 6. Variables and Facts
  7. 7. Conditionals and Loops
  8. 8. Handlers and Idempotency
  9. 9. Structuring Projects with Roles
  10. 10. Inventory Management
  11. 11. Using Ansible Vault for Secrets
  12. 12. Debugging and Troubleshooting
  13. 13. Real-World Automation Examples
  14. 14. Final Project: Deploy a Web Server
  15. 15. Bonus - What's Next with Ansible?
View path overview →

Red Hat's upcoming Automation Orchestrator (coming Q3 2026) runs task-based and event-based automation on a single governed canvas, built on the upstream Temporal durable-execution engine. Its 5-step pipeline puts a mandatory human gate at step 4 — "Humans approve" — between AI-generated remediation plans and anything that touches production. Below is a config example for that gate, modeled on the CVE-2024-6387 ("regresshion") remediation workflow demoed at Red Hat Tech Day Netherlands 2026.

Example: human review gate config

# workflow-step-4-human-review.yml
# Configuration for the "Human Review" gate node in an
# Automation Orchestrator workflow canvas.
step:
  name: "Human Review"
  type: human_approval
  position: 4

  # Plan submitted by the AI analysis step (step 3) for review
  input_from: "ai_analysis_and_recommend"

  approval:
    notify_users:
      - "priya.patel"
      - "j.oconnor"
      - "secops-oncall"

    message: >-
      Please approve this deployment to production.
      Remediation: patch sshd for CVE-2024-6387 (regresshion)
      across 12 hosts (prod/staging/dev), rolling update in
      3 batches of 4. Rollback strategy attached.

    timeout: 1d          # default timeout for the approval request
    on_timeout: fail      # no silent auto-approval on timeout

  on_approve:
    next_step: "automated_remediation"
  on_reject:
    next_step: "notify_and_close_ticket"

What it does

This node sits between the AI recommendation step and the automated remediation step in the orchestrator canvas. When the upstream AI analysis step (using an LLM with MCP tools such as Splunk Query, Splunk Alert Search, Splunk Saved Search, and ServiceNow CMDB Lookup) correlates an alert to a host group and matches an existing remediation job template, it hands off a plan — including a rollback strategy — to this gate instead of executing it directly.

The notify_users list determines who gets paged for sign-off; message is the exact text shown to reviewers, customizable per workflow. timeout bounds how long the workflow waits (1 day is the default shown at the event), and on_timeout: fail means an unanswered request fails the workflow rather than auto-approving it — the whole point of the gate is that nothing reaches production without an explicit human decision. Approval routes to automated_remediation (step 5, executed deterministically via AAP); rejection routes wherever your workflow needs, typically closing out the ticket without changes.

In the demoed run, this was the only manual segment of the pipeline: alert ingestion, ITSM ticket creation, vulnerability analysis, remediation execution, and ticket close together took under 10 seconds of automated time, while human review itself took 38.4 seconds. The remediation patched 12 hosts across prod/staging/dev in 3 batches of 4 with zero downtime, all health checks passing, and the associated ServiceNow ticket (INC0038291) was resolved and closed automatically once the gate approved.

Notes / Gotchas

  • Treat on_timeout: fail as the safe default. An automation platform that "isn't improvising against production infrastructure" should never silently proceed when nobody answered the approval request.
  • Keep notify_users scoped to people who can actually evaluate the specific remediation — a generic on-call rotation may not know how to judge a rollback strategy for a given service.
  • The approval message should always include enough context (CVE ID, affected host count, batch strategy, rollback plan) for a reviewer to decide without having to dig through the AI agent's reasoning trace.
  • This gate is triggered downstream of Event-Driven Ansible rulebooks reacting to webhook triggers (e.g., an IBM Instana or ServiceNow webhook hitting the EDA endpoint) — the approval step doesn't care how the alert arrived, only that a plan reached it.

A single configurable gate — who's notified, what they see, how long they have, and what happens if they don't answer — is what turns an AI-recommended remediation into something safe enough to run against production.

References

All Tutorials