Next.js OpenAI Approval Workflow Console

Описание и применение

Консоль на Next.js, где OpenAI генерирует ограниченный план действий для инцидента, оператор проверяет и одобряет, а сервер выполняет только утверждённые действия, защищая от нежелательных эффектов.

Задача

Operators need a safe way to let an LLM propose incident workflows while ensuring only approved, constrained actions are executed.

Результат

A secure, human‑approved incident workflow console that limits LLM output to two safe actions, validates them, stores plans, and executes only after approval, preventing accidental side‑effects.

Рабочий процесс

• 1. Operator submits incident details and selects runbook notes via a console UI.
• 2. Server route POST /api/plans receives the request, builds a visible context, and calls OpenAI with a prompt that restricts output to JSON with only create_task or send_webhook actions.
• 3. The response is parsed, validated against a Zod schema, and a plan object is created with a UUID, timestamp, and status "proposed".
• 4. The plan is stored in an in‑memory map (replaceable with durable storage).
• 5. Operator reviews the plan and approves it; the client sends a POST to /api/plans/[id]/execute.
• 6. The execute route reloads the stored plan, sets status to "executing", and processes each approved action in order, creating a local task or posting a webhook with a timeout and signature.
• 7. Upon success, the plan status is updated to "executed"; on failure it becomes "failed" and an error is returned.
• 8. The client displays the execution results and final plan status.

Доказательства

Build a TypeScript console where OpenAI proposes a constrained incident workflow, an operator reviews the exact model context, and the server executes only an explicitly approved stored plan.

Источник

The proposal is deliberately limited to two actions: create_task, which records a local task for this demonstration, and send_webhook, which posts a predefined event to one configured HTTPS destination.

Источник

The route does not send browser state, unrelated records, or arbitrary internal data to the model.

Источник