Fail-closed Python automation: dry runs, single-use approvals, and safe retries

Description and use

Fail‑closed pattern for Python automation ensures safe record writes: default dry‑run, explicit JSON payload approval, single‑use nonce, cross‑worker reservation, and append‑only audit.

Problem

Automations that create or update records risk unsafe states and lack auditability if they run without explicit approval and safeguards.

Outcome

The pattern ensures that only approved, non‑duplicate, and non‑concurrent writes occur, with full auditability and robust failure testing.

Workflow

• 1. Run script in dry‑run mode to validate inputs and compute payload. 2. Generate a canonical JSON representation of the payload. 3. Obtain explicit approval that binds to the JSON signature. 4. Store a unique nonce/approval ID in a transactional table. 5. Reserve work with a unique key and short DB transaction to prevent concurrent execution. 6. Execute the write only if approval and reservation succeed. 7. Log sanitized JSON lines to an append‑only audit trail. 8. Test that dry‑run never writes, modified payload fails approval, nonce reuse is rejected, and reservations are shared across workers.

Evidence

A dry run should validate inputs, compute the intended payload, and produce a machine-readable outcome without performing a live write.

Source

Store a nonce or approval identifier in a transactional table and consume it atomically.

Source