Automation case / 06 · Automated cleanup with guardrails

Designing a reconciler for stale downstream state

A fictional automation case: the execution side of reconciliation. The comparison model is in the Data & Integrations cases; this one is about acting on it safely.

Fictional scenario

Independently created. Contains no employer or client implementation detail, internal names or figures.

01The outcome

Downstream state converges on expected state every day; automated closes stay within guardrails; anything unusual goes to a person first.

The reality

Upstream eligibility changes, but campaign memberships, tasks and recovery processes stay behind—and cleaning them up is a quarterly manual job.

Architecture question

How does an automation close what should no longer exist—safely, and without closing real work?

Key decision

Run reconciliation as a scheduled automation with classified actions and guardrails, rather than as a periodic manual cleanup.

ContextAccounts move in and out of segments and eligibility every month. Entry automations work; exits are sometimes missed—an outage, a partial run, a rule change. Stale campaign memberships and tasks accumulate until someone cleans them up by hand.

Trigger

Daily, after the eligibility and segment publication for the day.

Done means
  • Stale memberships exited
  • Stale tasks closed with a reason—unless protected
  • Unusual volumes held for review
  • A drift report for the owner
Systems and partiesCRMCampaign platformData platform

02The reality · current state

What the automation does today.

  • Stale campaign memberships keep sending the wrong messages
  • Open tasks for accounts that recovered clutter owners’ lists
  • Recovery plans stay open for ineligible accounts
  • A bulk cleanup once closed tasks that sellers were working
  • Nobody knows how much drift exists at any time

03Target steps

Each step with its mode, its actor and its guard.

  1. 01
    Derive expected state

    From current segments and eligibility.

    AutomatedData platform
  2. 02
    Compare with actual

    Memberships, tasks and plans by account.

    AutomatedReconciler
  3. 03
    Classify differences

    Match, missing, stale (unexpected), conflicting.

    AutomatedReconciler
  4. 04
    Act within guardrails

    Close, exit or create—keyed and limited.

    OrchestratedCRM · campaignsGuardBlast-radius limit
  5. 05
    Owner review

    Held items and the drift report.

    HumanCommercial operations

04Key dimension · Automated cleanup with guardrails

Expected against actual—then act, within limits

The reconciler classifies every difference and acts only where the rule is clear and the change is small and reversible.

Expected downstreamActual downstreamCompared byAccountExpected actionActual actionWork in progress
Show
Expected downstream compared with Actual downstream, one row per key
KeyExpected downstreamActual downstreamOutcome
ACC-A12Retention campaignRetention campaignMatchBoth sides agree.
ACC-B07Recovery task open—MissingEntry automation failed during an outage.
ACC-C33No campaignRetention campaignUnexpectedAccount recovered; exit never ran.
ACC-D19Not eligibleRecovery plan openUnexpectedAccount left the population.
ACC-E02Review callRecovery call (in progress)DifferenceSegment improved while the seller was working the task.
  1. Match

    Downstream matches expected.

    Owner
    Nobody
    Action
    Record the check.
  2. Difference

    Present, but not what the segment requires.

    Owner
    Account owner
    Action
    Protected if in progress: suggest, don’t close.
  3. Missing

    Expected, not present.

    Owner
    Automation
    Action
    Create with the same key the entry would have used.
  4. Unexpected

    Present, no longer expected.

    Owner
    Automation
    Action
    Close or exit with reason and run ID—within the blast-radius limit.
  • Dry run first

    New rules report what they would do for a period before acting.

  • Blast radius

    An unusual share of closes holds the run for review.

  • Protected work

    Anything in progress or recently touched is suggested, never closed.

  • Reversibility

    Every automated close carries a reason and the run ID.

A reconciler that can close anything will one day close everything. The guardrails are the design.

05Execution safety

If it can run twice, it is designed to run twice.

Execution patternScheduled run record + batched, keyed actions + dry-run mode

Cleanup touches many records in several systems; it must be observable, limited and reversible.

Dry run
Default for new rules: report only
Blast radius
More than a set share of a population → hold for review
Protected records
Tasks in progress or touched in the last days are never auto-closed
Action keys
Account + action + run date
Reversible
Closed with a reason and run ID, so they can be reopened

06Exceptions & recovery

Not every failure is a retry.

  • Segment publication late DependencyExpected state not readySkip the run; no comparison against stale expectationsData team
  • Unusual close volume ValidationBlast-radius limit exceededHold the run for reviewCommercial operations
  • Campaign platform rate limit Transient · retryLimit errors on exitsBack off; continue next batchAutomation
  • Rule misconfigured ConfigurationDry-run report looks wrongKeep the rule in dry runRule owner

07The trade-offs

Credible options, judged against these premises.

Rejected

Quarterly manual cleanup

Tiny populations

Cost: Drift for months; risky bulk edits
Rejected

Fix every entry automation instead

When outages never happen

Cost: Exits still get missed; no measure of drift
Selected

Daily reconciler with guardrails

State that drives work in several systems

Cost: Guardrail thresholds need an owner

08The second layer

Questions that change the design.

Expected state

  1. Where does expected state come from?
  2. What if it is late or incomplete?
  3. Which downstream records are in scope?

Acting safely

  1. What may the reconciler close without asking?
  2. What is protected?
  3. How large a change is too large?

Ownership

  1. Who reviews held items?
  2. How is an automated close undone?
  3. How is drift reported over time?

09Decisions & outputs

What the work produces.

  1. 01Expected-state derivation
  2. 02Difference classes and actions
  3. 03Guardrails
  4. 04Dry-run mode
  5. 05Drift report