4.2 Automated Actors

Go to 4. Actors and Responsibilities

Automated Actors are software processes outside Crucible that initiate an operation, provide an input, receive a result, or respond to an operation without direct human interaction during that operation.

An automated process does not become a separately defined Crucible actor merely because Crucible can be invoked through software. A named Automated Actor belongs in this section only when an approved leaf requirement assigns that actor a specific interaction or responsibility.

Potential Automated Actors can include:

• Continuous integration or continuous delivery pipelines
• Scheduled automation processes
• External orchestration workflows
• Automated assessment processes
• Machine clients using a supported Crucible interface

These examples do not establish required actors or capabilities. They remain outside the defined operational model until approved leaf requirements identify their required interactions with Crucible.

Automated Actors operate within the same authorization, access-control, security-domain, resource, information-handling, and transfer restrictions that apply to human-initiated operations.

Automation does not independently:

• Grant access to an environment or resource
• Select unauthorized inputs
• Approve movement across a Transfer Boundary
• Accept operational or security risk
• Approve deployment or operational use
• Grant Accreditation, Operational Approval, or an Authority to Operate (ATO)

No approved leaf requirement currently identified for this page explicitly establishes a separate Automated Actor.

The page should be updated when an approved leaf requirement defines automated initiation, machine-to-machine interaction, scheduled execution, pipeline execution, or another automated actor responsibility.