Patterns

Trust and safety

The interface makes the safe path the obvious one. Risky actions are visible, named, deliberate and recorded, and some can only ever be done by a person.

Read-only sourcesTwo-person approvalAI suggests only

Read-only sources

Source stores are never written to. The interface says so wherever a source appears, and a violation surfaces as a blocking error, not a warning.

Source · read-onlyshop.alderandfinch.eu

The lock badge is part of every source card, picker and breadcrumb. It is never optional and never hidden behind a tooltip.

Error: Write blocked on a source store

ReadOnlyConnectorViolationError on Magento 2. The job halted before any request left Kramor. Nothing changed at the source.

Approvals

Approvers sign the hash of a locked revision, not a screen. The button stays disabled until every statement is confirmed, and the same person cannot give both approvals.

Lock and approve

Plan revision r15

Waves 4 to 9 with the resolved color mapping.

0 of 2

sha256:5d82c1f0…e1a94d

I reviewed the diff: 37,320 creates, 0 updates, 0 deletes

No destructive operations are included

A rollback plan is recorded

0 of 3 confirmed

AI proposes mappings and diagnoses problems. It never authorizes writes and never bypasses validation. Suggestions wear the insight color, say they come from AI, and can only be added to a draft that people then approve.

A suggestion and its outcomes

AI suggestion · needs your review

Map attribute_set.color to the option Color.

AI suggestion

Label the source of every suggestion

The insight color, the sparkle icon and the words “AI suggestion” appear together, every time.

Don't

Put AI on an approval or a destructive action

“AI recommends approving” on the approve button turns a suggestion into pressure. Approvals are for people only.

Destructive gate

Deletes and clear commands at the destination are disabled by default. Opening the gate needs the owner and a second factor, and every destructive action still uses a typed confirmation that repeats the count.

Gate closed

Default

Clear commands are skipped and listed as exceptions. Plans cannot include deletes.

See the typed confirmation

The overlays page has a working example that requires the exact phrase before the button enables.

Open the example

Human gates

Some actions are never automated, and the portal never offers a shortcut around them. Requesting one records an escalation for its owner instead of acting.

Production cutoverPointing the storefront domain at Shopify and switching off Magento checkout.

Escalation required

Destructive data changesAny delete or clear command at the destination. Off by default.

Gate closed

Secret rotationReplacing a store credential. Records an escalation instead of acting.

Escalation required

Disabling a quality gateSkipping read-back or the two-approver rule for any wave.

Escalation required

Secrets and tenancy

Credentials appear only as references. There is no reveal button anywhere. Every screen names the tenant it is scoped to, so no one acts on the wrong workspace.

Shopify Admin API tokensec_01HZ4M9R7T · value never shown

Alder & FinchTenant tnt_8Q2F7K1M · shown in the switcher and breadcrumbs

Read-only sources

Approvals

Plan revision r15

AI suggestions

Destructive gate

Human gates

Secrets and tenancy