Getting started

Key concepts

A few mental models that explain how DunOps works — and why every action waits for your approval before running.

Approval gates

Every mutating action — a deploy, a DNS change, a secret rotation — goes through an approval gate. DunOps composes a plan from your intent, shows it to you as a structured card, and waits. You approve and it runs. You dismiss and nothing happens.

This is the single most important property of DunOps: the AI agent plans, but a human decides. No matter how confident DunOps is about what you want, it will not execute a change to your infrastructure without an explicit click of Confirm.

Warning

DunOps never executes a mutation without your explicit approval. Read-only operations (listing resources, reading logs) run immediately — only writes wait for a gate.

Approval gates also act as a natural checkpoint for reviewing what DunOps understood from your intent. If the plan card shows something unexpected, dismiss it and rephrase — the gate exists precisely so you can catch misinterpretations before they reach production.

Plan cards

A plan card shows exactly what will change — the provider, the resource, the action, and any parameters. For DNS changes it shows a before/after diff. For deployments it shows the branch, commit, and target environment. You review the card and click Confirm or Dismiss.

Plan card shape (simplified)

{
  provider: "vercel",
  action: "create-deployment",
  resource: "storefront",
  params: { branch: "main", env: "production" },
  diff: null,         // shown for DNS and config changes
  requiresApproval: true
}

When diff is non-null (DNS record edits, environment variable updates, config file changes), the card renders a color-coded before/after view so you can see the exact bytes that will change. Nothing is elided or summarised — you see the full diff before committing.

Actions that show a diff

DNS record create / update / delete
Environment variable add / update
Config file edits
Secret rotation (masked values)

Actions that show parameters

Deployments (branch + commit)
Infrastructure provisioning
Database migrations
Scaling operations

Playbooks

A Playbook is a saved, named graph of steps. Once you've run a flow successfully in chat, save it as a Playbook. Next time, trigger it with a single message: Run "Deploy to prod". Playbooks support parameters, conditions, and multi-step sequences — all still behind the same approval gates.

Playbooks are most useful for flows you run regularly — weekly deploys, nightly database snapshots, on-call secret rotations. Once a Playbook is saved, any member of your workspace can trigger it without needing to know the underlying steps.

What a Playbook can contain

Sequential steps (A → B → C)
Conditional branches (if deploy fails, roll back)
Parameterised inputs (branch name, environment)
Multi-provider steps (GitHub + Vercel + DNS)
Approval gates at each step or only at the start
Notifications on success or failure

Save from chat

After a successful chat flow, click the Save as Playbook button in the chat header. DunOps captures the exact steps, inputs, and providers and opens the Playbook editor pre-filled.

Audit trail

Every action — attempted, approved, or dismissed — is logged in an immutable audit trail. You can see who approved what, when, and with what parameters. The trail is visible in Settings → Audit log.

Audit entries include:

Who — the workspace member who triggered or approved the action
What — the provider, resource, and action type (e.g. vercel.create-deployment)
When — UTC timestamp at plan creation and at approval/dismissal
Parameters — the exact inputs passed to the provider (secret values are redacted)
Outcome — success, failure, or dismissed before execution

Note

The audit log is append-only. Entries cannot be edited or deleted by any workspace member, including the owner. This makes it suitable for compliance workflows where a tamper-evident record is required.

Next steps

Quick start →

From zero to your first deploy in under 10 minutes.

Create a playbook →

Turn a successful chat flow into a reusable graph.