Process: CampusAccess — after-hours building access exceptions

Manual today:

1. ServiceNow request (building, rooms, window, reason)
2. Clerk checks Workday employment active
3. Clerk checks LMS safety training complete
4. Clerk creates temporary badge grant in access-control system
5. Slack #campus-security + email requester
6. BSL-2 / lab after 10pm needs lab director signature (PDF today)
7. Morning revoke often forgotten → orphan grants

Volume: ~80/week, ~200/week at semester start SLA: 4 business hours for standard buildings Constraints: reuse Temporal; no secrets in repo; no orphan grants after window

Ask: full production automation architecture (design mode). Do not execute.

Enterprise Automation Architecture

1. Decision Summary

| Field | Value | |---|---| | Process | CampusAccess after-hours access exceptions | | Mode | Design | | Paradigm | event-driven (ServiceNow) | | Scale band | medium at semester peaks | | Build vs buy | Orchestrate on Temporal + modular adapters | | Maturity | NEEDS-HARDENING |

2. Human-automation boundary (excerpt)

| Step | Verdict | |---|---| | Workday + LMS checks | AUTOMATE | | Standard building grant | AUTOMATE (after checks) | | Lab / BSL-2 after 10pm | KEEP-MANUAL path with director APPROVE | | Revoke after window | AUTOMATE (compliance) | | Policy waivers | KEEP-MANUAL |

3–4. Paradigm & build recommendation

Event-driven async workflow (not nightly batch). Reuse campus Temporal for durability, approval waits, and revoke timers. Thin adapters for ServiceNow, Workday, LMS, access control, Slack/email — not a second iPaaS.

5–6. Contracts & reliability

• Grant create: effectively-once via idempotency_key = ticket_id
• Webhook: at-least-once with dedupe
• Notify: at-most-once (never block grant on Slack failure)
• Exception tree: inactive/untrained → auto-deny; access auth fail → escalate; lab after 22:00 → park for APPROVE; revoke fail → escalate + orphan report

7–8. Security & HITL

Threats: stolen creds, over-privileged bot, webhook spoofing, PII in logs. Secrets manager only. Least-privilege grant/revoke role. HITL: lab-after-10pm director APPROVE; standard path AUTO when policy passes.

9–10. Observability & rollout

Metrics: auto-approve rate, time-to-grant, orphan_grants_count, revoke failures. SLO: 4h standard decisions; zero orphans older than 24h. Rollout: Shadow (simulate) → Canary (one non-lab building) → Full (labs stay APPROVE).

11–14. ROI, testing, runbook, maturity path

Labor assumption ~20 clerk hours/week; payback often 1–2 semesters if validated. Tests: policy, idempotency, revoke timer, chaos on access API. Runbook: detect → triage by ticket_id → recover → communicate. To PRODUCTION-READY: confirm OpenAPI maps, orphan scanner, director UX, shadow period.

15. JSON

Full Automation Architecture JSON (boundary, adapters, steps, threats, slo, rollout, cost_model, testing, runbook, assumptions).