Workflow engineering
Automations that survive their author.
I build the workflows your team repeats by hand: supplier invoice checks, helpdesk triage, lead replies, contract notice reminders. The rules are written down, a person decides anything that matters, and you receive the flows, the exports and the runbooks. Twelve use cases below say what is built, what was tested and what is design only.
- 1A mail-flow rule copies the message
- 2Auto-replies, loops and unknown senders stop
- 3Card numbers and passwords are redacted
- 4The request is read and categorised
- 5Priority P1 to P4 from a fixed matrix
- 6The response target is counted in business hours
- 7A first reply is drafted and labelled as AI
- 8The ticket is stored and an engineer owns it
What I automate
Pick a department, then a use case. Each one shows the flow, where a person decides, how the result is measured and what backs it. For every one I record your baseline first and report your own numbers afterwards. I state no percentage in advance.
- Running in demo mode
- Tested on invented data
- Built, partly tested
- Built, no test record yet
- Design only
What the five labels mean
- Running in demo mode
- Tested on invented data
- Built, partly tested
- Built, no test record yet
- Design only
IT and security operations
Helpdesk ticket triage
Running in demo mode- The problem
- Employees email IT and wait while engineers sort, prioritise and answer the same questions by hand.
- Who feels it
- The IT lead or office manager of a firm with 10 to 200 people.
- Built on
- Make
- Trigger
- A message reaches the shared helpdesk mailbox in Microsoft 365.
- Where a person decides
- The engineer owns every ticket and runs it by replying #ack, #resolved, #priority, #open or #report. Follow-ups count only from the verified requester.
- How it is measured
- Seconds from email to ticket, reply and alert, response targets met, and tickets by category in the monthly #report. I record your baseline first.
- What backs it
Running in demo mode on my own domain. Only @itsailor.io senders get tickets and replies.
Make scenario "Helpdesk ticket triage", version 3.1.
Where the AI runs. Make's default AI models process the redacted text in the United States (asserted, Make documentation, read 2026-10-12). Redaction removes card numbers, IBANs, passwords and codes, but the text still holds personal data. In your deployment the scenario runs on your own Make account, so that transfer runs under your agreement with Make. Which model and region a step uses, and whether it can stay in the EU, I confirm in writing before a customer commits.
The flow, step by step
- 1RulesExchange OnlineMake
An Exchange Online mail-flow rule copies the message to the scenario. The original stays in the mailbox.
- 2Rules
Auto-replies, loops, floods and unknown senders stop here.
- 3Rules
Card numbers, IBANs, passwords and codes are redacted before any AI step.
- 4AI, USMake
The request is read: category, language, who is affected, a security signal and the matching knowledge-base article.
- 5Rules
Priority P1 to P4 comes from an impact and urgency matrix. A clicked phishing link or an entered password is always P1.
- 6Rules
The response target is counted in your business hours and your public-holiday calendar (the demo uses Malta's).
- 7AI, USMake
A first reply is drafted from your own article and labelled as AI. Fixed text replaces it if a check fails.
- 8PersonMicrosoft 365 mail
The ticket is stored. The employee gets a reference and first steps and the engineer is alerted. A P1 or security ticket also triggers a separate escalation email. The engineer owns it from there.
Exploited-vulnerability watch (CISA KEV)
Built, no test record yet- The problem
- CISA adds actively exploited vulnerabilities to a public catalogue. Matching them to the vendors you run is a chore that gets skipped.
- Who feels it
- The IT lead, who sees it late or not at all.
- Built on
- Make
- Trigger
- A daily schedule.
- Where a person decides
- The engineer decides what to patch and when.
- How it is measured
- Hours from the CISA listing to the alert, repeat alerts for the same CVE, and the number of listed CVEs that matched your vendors.
- What backs it
Built and switched off. It used Make credits in my own test runs, but no test record is on file, so no count is shown.
Make scenario "Exploited-vulnerability watch (CISA KEV)".
It is a triage aid. It does not scan your systems, and it makes no NIS2 claim.
Where the AI runs. These steps use Make's built-in AI provider, which processes in the United States (asserted, Make documentation, read 2026-10-12). The scenario has no AI provider connection of its own (read in Make, 2026-10-18). The text they read is public. Which model and region a step uses, and whether it can stay in the EU, I confirm in writing before a customer commits.
The flow, step by step
- 1RulesCISA
CISA's Known Exploited Vulnerabilities catalogue is downloaded, with retries.
- 2RulesMake data store
Your vendor list is read from the data store.
- 3Rules
Recent entries that match your vendors and have not been alerted before are kept. The window is the last two days unless you set another.
- 4RulesFIRST.org
FIRST EPSS exploit-probability scores are added.
- 5AI, USMake AI Toolkit
The AI ranks three actions from those fields only: known ransomware use, then EPSS, then the CISA due date. It cites CVE IDs and may not invent versions or patches.
- 6PersonMicrosoft 365 mailMake data store
The matches go out in one email with the due date and the required action. Each CVE is alerted once and then remembered, so it is not sent again. The engineer decides what to patch and when.
Licence reclaim
Design only- The problem
- Paid Microsoft 365 licences stay assigned to people who stopped signing in. Finance sees the invoice and IT sees no reason to look.
- Who feels it
- Finance and IT.
- Built on
- n8n or Power Automate (design only)
- Trigger
- A monthly schedule.
- Where a person decides
- The manager decides keep or release, and IT executes.
- How it is measured
- Seats released a month and the change on your licence invoice.
- What backs it
Nothing is built or tested for this case.
Reading sign-in activity through Microsoft Graph needs Microsoft Entra ID P1 or P2 and the AuditLog.Read.All permission, with Directory.Read.All granted beside it (Microsoft Learn, read 2026-10-27).
Freeing a seat in Entra ID does not lower the bill by itself. On a Microsoft CSP subscription the licence quantity can be reduced only within seven days of the licences being added, and otherwise at the next renewal window (Microsoft Learn, read 2026-10-27). The term decides when a removal saves money.
The free Licence Overlap Check covers add-on overlap only.
The flow, step by step
- 1RulesMicrosoft GraphEntra ID
Licensed users with no sign-in for 90 days are listed.
- 2Rules
Shared, service and break-glass accounts are dropped.
- 3PersonMicrosoft 365 mail
Each manager gets one email with one link: keep or release.
- 4Record
With no answer in 14 days, a ticket goes to IT.
- 5PersonEntra IDYour licence portal
IT confirms, then the licence is removed. The subscription term is checked first.
- 6Record
A monthly report lists seats released and seats kept, with the manager's reason.
Finance and accounts payable
Supplier invoice checks with a bank-detail change block
Built, partly tested- The problem
- Invoices arrive by email and get keyed in by hand, and a changed bank account can slip through.
- Who feels it
- Accounts payable feels it first.
- Built on
- Make
- Trigger
- An invoice PDF or photo reaches the accounts payable mailbox.
- Where a person decides
- Every payment. A BLOCKED invoice needs a call-back to a number you already hold, and new bank details count as trusted only when an approver replies VERIFIED with the reference.
- How it is measured
- Flags raised and confirmed by AP each month, duplicates and changed accounts caught, and minutes of checking per invoice against your baseline. I claim no fraud-prevented amount.
- What backs it
Built and switched off. The real invoice reader needs a paid Make plan and has not run, so how well it reads real invoices is untested. Two of the five planned rule cases were not run.
Make scenario "Supplier invoice intake (AP controls)", version 3.1. The test files are two fictitious Northwind invoices: 0418 is meant to need review and 0431 is meant to be BLOCKED. The rule cases ran with a stand-in reader, so the real reader has not read either file.
Where the AI runs. The invoice reader is Make's AI extractor, which runs on Microsoft Azure AI in the EU, as Make states (asserted, Make documentation, read 2026-10-12).
The flow, step by step
- 1RulesExchange OnlineMake
A mail-flow rule copies the message to the scenario.
- 2Rules
The message is screened. Signature images and the scenario's own emails are ignored.
- 3AI, EUMake AI extractorMicrosoft Azure
The invoice is read: supplier, VAT number, amounts, dates and IBAN.
- 4Rules
Duplicates are caught: same number, same file, or same supplier, amount and date.
- 5Rules
Bank details are checked: the IBAN checksum, the supplier's verified accounts, an account known for another supplier and change requests in the email text.
- 6RulesEU VIES
The supplier VAT number is checked in VIES and the consultation number is kept.
- 7Rules
Invoice rules run: addressed to you, VAT rate or reverse charge, arithmetic, dates and your approval threshold. The built version has Maltese VAT rates, and other countries' rates are configured per customer.
- 8PersonMicrosoft 365 mail
AP receives one email per message: Checks passed, Review or BLOCKED for each invoice, with the next action. A person makes every payment decision.
Paid order to VAT-checked invoice
Tested on invented data- The problem
- A shop that sells across EU borders decides the VAT treatment and checks each VAT number by hand.
- Who feels it
- The owner or the accountant carries it.
- Built on
- n8n
- Trigger
- A paid order from Stripe, Shopify or WooCommerce.
- Where a person decides
- Your accountant signs off the rules before the first live invoice and clears the review queue.
- How it is measured
- The share of orders that end as a final invoice with no person touching them, and the size of the exception queue. Not measured yet: I record your baseline first.
- What backs it
Built and switched off. The Xero tax codes are placeholders until your accountant maps them. It is decision support for an accountant and gives no tax advice.
A ready-made Automation Library workflow for VAT-checked invoicing.
The flow, step by step
- 1RulesStripeShopifyWooCommerce
A paid order arrives. Unpaid, cancelled, test and zero-amount orders are ignored.
- 2Rules
The order is put in one shape with amounts in cents. A repeat of the same order does nothing.
- 3RulesEU VIES
A business customer in another EU state with a VAT number gets a format check, then a VIES check. The answer is stored.
- 4Rules
A rule table sets the treatment: domestic rate, reverse charge, destination-country rate under OSS, or review.
- 5Rules
Amounts are computed in cents and rounded per line.
- 6RulesXeroResend
A sales invoice is created in Xero. Clean cases are authorised and emailed, and the rest stay draft. The flow sends none to a national e-invoicing system.
- 7Personn8n data tableTelegram
Unclear cases go to a review queue and staff are alerted. The workflow never marks one approved.
- 8Record
On the first of the month the owner gets last month's OSS sales by country and rate.
People
Leaver and mover access
Design only- The problem
- Staff leave and nobody removes the access, licence or mailbox until someone notices. HR and IT each assume the other did it.
- Who feels it
- HR and IT, both.
- Built on
- n8n or Power Automate (design only)
- Trigger
- An HR system marks a leaver or a mover, or a form does if there is no HR system.
- Where a person decides
- A named approver releases privileged accounts, and the manager chooses what happens to the mailbox and the files.
- How it is measured
- Hours from the HR leaver date to sign-in disabled, and licences reclaimed, both read from the execution log.
- What backs it
Nothing is built or tested for this case. A flow that changes accounts needs a write-capable app registration, which I scope to a named group and log.
Next to it: the free Offboarding Runbook and Leaver Check puts the leaver steps in order, with the PowerShell for each step that has a command and a field for the evidence. It runs in your browser and changes nothing. A generator in my codebase turns a read-only Microsoft Graph scan into a dry-run PowerShell runbook, and it changes nothing either.
The flow, step by step
- 1RulesHR systemn8n
The event arrives.
- 2Rules
The record is checked: department code, leaver date and a privileged or executive flag.
- 3PersonTeams approval
Privileged and executive accounts wait for a named approver.
- 4RulesEntra IDMicrosoft Graph
Sign-in is disabled and sessions are revoked.
- 5RulesExchange Online
The mailbox becomes shared, with the agreed forward.
- 6RulesEntra ID
Group memberships and licences are removed.
- 7RulesOneDrive
OneDrive is handed to the manager.
- 8Record
A log records what changed, when, and which rule fired.
Compliance and back office
Contract intake and renewal-notice reminders
Built, no test record yet- The problem
- Contracts renew automatically unless notice is given by a date buried in a clause. The owner finds out after the renewal.
- Who feels it
- The owner or the procurement lead.
- Built on
- Make
- Trigger
- Someone emails a contract PDF to the intake address.
- Where a person decides
- You decide to renew, renegotiate or give notice. The extraction is a reading aid and gives no legal advice.
- How it is measured
- Deadlines registered against contracts on file, and deadlines that passed with no reminder sent.
- What backs it
Built and switched off. The reminders scenario ran in test runs and the intake scenario shows no executions in Make's credit log. No test record is on file, so no count is shown.
Make scenarios "Contract intake: renewal and risk terms" and "Contract renewal reminders". The test file is a fictitious Northwind Analytics contract.
Where the AI runs. Make's built-in AI provider processes in the United States (asserted, Make documentation, read 2026-10-12). This scenario reads the contract with a Make AI agent and has no provider connection of its own (read in Make, 2026-10-18). Where that agent's model processes the contract is not confirmed, and I confirm it in writing before a customer commits. The contract holds personal data, such as the people who signed it, and in your deployment that transfer runs under your agreement with Make.
The flow, step by step
- 1RulesMake
The contract PDF arrives at the intake mailhook. Each PDF attachment is read and other files are ignored.
- 2AI, region to confirmMake AI agent
An AI agent fills fixed fields: parties, effective date, end of term, auto-renewal, renewal term, notice period and method, price-change clause, liability cap, governing law and annual value. Anything the contract does not state stays empty or zero. It adds up to three risk notes that cite clause numbers.
- 3Rules
The notice deadline is worked out from the end of the term and the notice period, and the days left are counted.
- 4RecordMake data store
The contract and its notice deadline are registered.
- 5RulesMicrosoft 365 mail
A confirmation email says what was registered and flags the risks.
- 6PersonMicrosoft 365 mail
Daily, a second scenario sends one reminder digest at 60, 30, 14, 7, 3, 1 and 0 days before each notice deadline, with the notice method. You decide to renew, renegotiate or give notice.
Client document chasing
Tested on invented data- The problem
- Each month the same clients owe the same papers. Staff write the reminders and open every upload to check it is the right paper for the right month.
- Who feels it
- Accountancy and corporate-service firms with two or more people.
- Built on
- n8n
- Trigger
- The first of each month at 06:00.
- Where a person decides
- Staff clear the review queue. The flow verifies no identity and gives no audit opinion.
- How it is measured
- Days from due date to receipt, reminder emails staff no longer write, and the share of uploads in review, against one monthly cycle of your current process. I state no percentage in advance.
- What backs it
Built and switched off. The Google Drive and PDF-reading steps were replaced by fixed answers in the tests, so none ran live, and the model reading has not been measured. Real client documents have not been processed yet.
Automation Library line P1, client document chaser.
Where the AI runs. AI steps call Mistral's EU endpoint, which uses data centres in the EU and EFTA (asserted, Mistral documentation, read 2026-10-15). No live call has run yet because the credential is not attached. Mistral may handle account and billing data outside that region.
The flow, step by step
- 1Recordn8n data table
One checklist row per client, document type and period is created, each with its own upload link.
- 2RulesResend
Reminders go out 7, 3 and 1 days before the due date, then every 3 days when overdue, up to 4.
- 3Rules
After the last reminder, one escalation goes to staff.
- 4Rulesn8n form
The client uploads a PDF, JPG or PNG through the personal link.
- 5AI, EUMistral EU endpoint
A safety check and a small model read the first 4,000 characters for type, period and name.
- 6Rules
Fixed rules, not the model, decide received or review. Mismatches are never forwarded.
- 7RecordGoogle Drive
Files go to the client's folder, filed by end client, period and document type.
- 8Person
On Monday staff get the overdue board and clear the review queue. Table rows are deleted after the retention period.
Sub-processor change monitor (GDPR Art. 28)
Built, no test record yet- The problem
- Suppliers add sub-processors on their own schedule and announce it on a web page. The DPO or IT lead learns about it at the next audit.
- Who feels it
- The DPO or the IT lead.
- Built on
- Make
- Trigger
- A weekly schedule.
- Where a person decides
- Your organisation, as controller, decides whether to object, after the DPO or whoever handles data protection has assessed the change.
- How it is measured
- Days from a vendor page change to the DPO alert, and false alerts per quarter.
- What backs it
Built and switched off. It ran in my own test runs, but no test record is on file, so no count is shown.
Make scenario "Sub-processor change monitor (GDPR Art. 28)".
It is a monitoring aid and gives no legal advice.
Where the AI runs. These steps use Make's built-in AI provider, which processes in the United States (asserted, Make documentation, read 2026-10-12). The scenario has no AI provider connection of its own (read in Make, 2026-10-18). The text they read is public. Which model and region a step uses, and whether it can stay in the EU, I confirm in writing before a customer commits.
The flow, step by step
- 1RulesHTTP
Each vendor's public sub-processor page is fetched.
- 2Rules
The text is cleaned and fingerprinted (SHA-256). A first run only stores a baseline.
- 3Rules
If the fingerprint is unchanged, the run stops.
- 4AI, USMake AI Toolkit
If it changed, the AI extracts the list of sub-processors from the new page: name, country and purpose.
- 5AI, USMake AI Toolkit
A second AI step compares that list with last week's. Only added, removed or relocated sub-processors count as a material change, and formatting differences are ignored.
- 6PersonMicrosoft 365 mail
The DPO, or whoever handles data protection, gets one alert with what to check: the objection window under the DPA and the transfer mechanism for any non-EEA country. The organisation, as controller, decides whether to object.
Customer service
Order-status answers and withdrawal requests
Tested on invented data- The problem
- "Where is my order?" emails and withdrawal requests fill the support inbox.
- Who feels it
- Support staff, or the owner of an online shop that sells to consumers.
- Built on
- n8n
- Trigger
- A mail to the shop mailbox, a contact-form post, or the "Withdraw from contract here" link.
- Where a person decides
- Automatic sending is off until you switch it on. The automation never refuses a withdrawal, and no refund runs without approval.
- How it is measured
- The share of order-status tickets answered automatically and the median first response from the 18:00 report, with the number of tickets.
- What backs it
Built and switched off. Shopify, Gmail and Mistral calls are untested. The customer wording is template version 2; the shop approves the wording its customers see before go-live. This is a tool and gives no legal advice.
Automation Library lines E1 and E2, the post-purchase desk.
Where the AI runs. AI steps call Mistral's EU endpoint, which uses data centres in the EU and EFTA (asserted, Mistral documentation, read 2026-10-15). No live call has run yet because the credential is not attached. Mistral may handle account and billing data outside that region.
The flow, step by step
- 1RulesGmail
Mail arrives. Auto-replies, bulk mail, bounces and my own addresses are ignored.
- 2AI, EUMistral EU endpoint
A safety check screens the subject and body, with a rules pass and an AI check.
- 3AI, EUMistral EU endpoint
A model sorts it: order status, return, product question, complaint or other.
- 4RulesShopifyWooCommerce
The order is looked up, and only the sender's own orders are shown.
- 5AI, EUMistral EU endpoint
The reply is written from facts only: status, carrier, tracking and dates. A code check rejects any invented number, date or promise.
- 6PersonTelegram
A reply is sent automatically only for a verified sender, a found order, high confidence and every check passed. Otherwise a notice arrives in Telegram, and staff approve, edit or reject the draft on my server; the draft itself never goes through Telegram.
- 7Rulesn8n formResend
A withdrawal goes through a hosted form. The customer gets an acknowledgement with what was submitted and the date and time, and the 14-day deadline is tracked.
- 8PersonStripeShopify
A refund runs only after a person approves it. Staff get a daily digest of deadlines.
After-hours enquiry desk on WhatsApp and web chat
Tested on invented data- The problem
- The same questions arrive on WhatsApp and the site chat after hours, and reception or the owner answers at night.
- Who feels it
- Reception, or the owner.
- Built on
- n8n
- Trigger
- A WhatsApp message or a web-chat message.
- Where a person decides
- A person takes every hand-over, and the owner decides what goes into the knowledge table.
- How it is measured
- The share of conversations closed without staff and the leads captured after hours. Not measured yet.
- What backs it
Built, reviewed and switched off. The WhatsApp, Cal.com and Google Calendar calls were replaced by fixed answers in the tests, so none ran live. Answer accuracy with a real model has not been measured.
Automation Library line L3, message receptionist.
Where the AI runs. AI steps call Mistral's EU endpoint, which uses data centres in the EU and EFTA (asserted, Mistral documentation, read 2026-10-15). No live call has run yet because the credential is not attached. Mistral may handle account and billing data outside that region.
The flow, step by step
- 1RulesWhatsApp Cloud APIn8n chat
A message arrives.
- 2AI, EUMistral EU endpoint
A safety check runs, with a rules pass and an AI check.
- 3AI, EUMistral EU endpoint
The agent answers from your knowledge table: services, hours, rules and directions. Its first message says it is AI and names your business.
- 4RulesCal.comGoogle Calendar
It offers a booking link or checks slots.
- 5Record
It saves the lead.
- 6PersonTelegram
When it cannot answer, or the topic is sensitive, it alerts a person in Telegram with a link, and they read the conversation on my server.
- 7Record
A daily summary lists the unanswered questions, so you can extend the knowledge table.
Sales and leads
Speed-to-lead: a first reply while the lead is warm
Tested on invented data- The problem
- Website enquiries wait hours while the team is busy, and the lead goes cold.
- Who feels it
- The owner or the sales lead.
- Built on
- n8n
- Trigger
- A form post or a webhook from your website.
- Where a person decides
- A salesperson takes every hot lead, and staff set the lead status.
- How it is measured
- Median seconds from enquiry to first reply, with the number of leads, against your own baseline.
- What backs it
Built and switched off. Real email, Telegram and Mistral calls are untested. A first reply in under a minute is a design target and has not been measured live.
Automation Library line X2, speed-to-lead.
Where the AI runs. AI steps call Mistral's EU endpoint, which uses data centres in the EU and EFTA (asserted, Mistral documentation, read 2026-10-15). No live call has run yet because the credential is not attached. Mistral may handle account and billing data outside that region.
The flow, step by step
- 1Rulesn8n
The lead arrives from the hosted form or from your site backend through a webhook with a secret header.
- 2Rules
Spam and duplicate checks run. A spam row keeps no personal data.
- 3AI, EUMistral EU endpoint
A safety check blocks injected instructions and redacts personal data, with a rules pass and an AI check.
- 4RulesEU VIES
Enrichment never blocks the flow: a VIES check for a VAT number and the homepage title.
- 5AI, EUMistral EU endpoint
The lead is scored against your budget, location and timeline by rules. AI adds the reasons.
- 6AI, EUResendMistral EU endpoint
The reply carries your booking link and at most one AI sentence that fixed rules check. The footer says it was sent automatically.
- 7PersonTelegramCal.com
The lead is saved. A hot lead alerts a named salesperson, and chasers go out at 24 h and 72 h until the lead books or replies.
- 8Record
On Monday the owner gets a funnel report.
You leave with
A ranked automation backlog
Every candidate scored by volume and cost per loop, so the first wave is the highest-return work, not the loudest request. You keep the backlog whether or not I build.
Flows in your git, with promotion history
Every change is a commit you can read, in a repository you own. dev, staging and prod where the platform supports it. Power Platform has native ALM, and n8n has built-in environments only on its Business and Enterprise plans (asserted, n8n documentation, read 2026-10-29). Everywhere else, including the n8n Community edition, Make and Zapier, I commit exports. I say which applies before you build.
An SLO sheet per flow
Volume, success-rate and latency targets, an alert channel and a named owner for each flow, on the SLO sheet template in the kit. The design goal is that the owner hears about a break before a customer does.
The transfer-out runbook, from week one
It is written before the first flow ships: the export limits of each platform, the credentials map (where each one is kept and who holds it, never the secrets) and the SLO sheet, so that leaving is a handover.
What is in the delivery kit
Overview
What the kit is, how each file maps to the service, and the weeks 1-3 read-only / weeks 4-10 build engagement flow.
README.mdBootstrap
Read-only access to the systems a flow will touch, before anything is built.
00-bootstrapSOP-access-and-tooling.md
Runbooks
Ten runbooks. RUNBOOK-06 is broken-flow triage; RUNBOOK-10 is the transfer-out, with the export limits of each platform written down.
02-runbooksREADME.mdRUNBOOK-01-process-inventory.mdRUNBOOK-02-platform-selection.mdRUNBOOK-03-flow-build-standard.mdRUNBOOK-04-git-and-environments.mdRUNBOOK-05-observability-and-slo.mdRUNBOOK-06-broken-flow-triage.mdRUNBOOK-07-ai-step-guardrails.mdRUNBOOK-08-coe-and-dlp.mdRUNBOOK-09-cost-and-platform-migration.mdRUNBOOK-10-transfer-out.md
Flows
The starter flow pack: two sanitised exports of flows on my own n8n instance, with node names and structure verbatim and node code summarised. A reading example, not a ready-to-import automation. The naming convention lives in the README.
flowsREADME.mdcsp_order_provisioning.sanitised.jsonpax8_catalog_sync.sanitised.json
Observability
The per-flow SLO sheet template: owner, volume, success-rate and latency targets, alert channel, runbook link.
observabilityslo-sheet.md
Governance
The Power Platform Center of Excellence baseline checklist: environments, DLP, connector governance, ALM, citizen-dev guardrails.
governancecoe-baseline-checklist.md
Exit kit
Everything operable without me: flows in your git, the credentials map (where each one is kept and who holds it, never the secrets), the SLO sheet, the runbooks. No exit fee.
EXIT-KIT.md
How an engagement runs
Weeks 1-3 are read-only process mapping. Nothing is built until you sign the ranked backlog.
Map, read-only
Least-privilege read access to the systems a flow will touch, and an interview with each function about manual handoffs. Each candidate gets its volume and its cost per loop written down.
Rank the backlog
Every candidate is scored by volume and cost per loop, each with a named owner. You sign it, and you keep it whether or not I build.
Pick the platform per flow
n8n, Make or Power Automate, chosen flow by flow on connector coverage, data residency and what your team can maintain. Where an AI step runs is named before you commit.
Build against invented data
Each flow gets a test table: the happy path, edge cases, injection attempts on every AI step, a dependency failure and a privacy case. An automated review pass, not a person, then tries to break it, and I read every failing case before a client goes live.
Commit to git and watch it
Every change is a commit in a repository you own. Which environments exist depends on the platform, and "You leave with" says which. Each flow gets volume, success-rate and latency targets, an alert channel and a named owner.
Hand over, or operate
The transfer-out runbook is written in week one, before the first flow ships. You leave with the flows, the exports and the runbooks, or I run them under the Operate retainer, in business hours, with the monitoring and triage terms your Statement of Work sets.
What is not included
AI features inside your own product
Model choice, evals and prompts inside an app you sell. When the AI is the product, not a step in a workflow, I take it on as contract days.
No UI-scraping RPA bots
If a vendor has no API, I say so and price the workaround.
Ready-made workflows that I run for you
This page is for automations built to your brief. The library is the other route: tested workflows that I run on my own instance, so you never touch the editor.
Deliberately out of scope
The engagement does not cover:
- Replacement of full ERP or CRM workflow modules (case by case)
- A training programme for people who build flows themselves (a separate engagement)
- Off-hours emergency response
Check it before you scope it
The use cases above that have a test record show its count and its date, and say what the test did not cover. The method is on the Automation Library page.
The Workflow Engineering Starter Flow Pack is a free download: two sanitised n8n workflow exports from my own instance, a broken-flow triage runbook and the operating notes needed to adapt them. Credentials and implementation code are removed.
The free Automation ROI Scenario Builder takes six operating numbers for one workflow and returns a low, centre and high annual value, with every assumption printed beside it.
Pricing
Scoped to you.
- Essential
- Your first 3-5 automations, built and handed back. Fixed scope, 4 to 10 weeks, mapping included.
- Operate
- The Operate retainer: ten hours a month on the flows I built, no roll-over. Monthly, 30 days' notice for either party.
- Billing basis
- Essential is a fixed fee set in the Statement of Work before work starts, after the 30-minute call. Operate is the monthly retainer.
- Contract days
- From €600 a day. Excluding VAT. Minimum two days. Invoiced monthly in arrears. Remote, Central European Time.
- Platform and licences
- The platform subscription and any licences a flow depends on are billed to you separately, by the platform vendor or by your licence provider, under your own agreement. They are never hidden inside my fee.
- Ready-made instead
- Workflows that I run for you carry a setup fee and a monthly fee, quoted in writing.See the Automation Library
- Currency
- EUR, excluding VAT.
- VAT
- Reverse charge for EU businesses outside Malta whose VAT number validates in VIES. Malta VAT otherwise.
- Invoiced by
- Michal Jatczak, sole trader registered in Malta.
- Service level
- No SLA and no on-call duty. Dates are written into the Statement of Work.
What each tier includes
Essential
Your first 3-5 automations, built and handed back.
- Process-mapping workshop on your top manual loops
- 3-5 automations built on the platform that fits each one
- Source-control integration where the platform allows
- Basic monitoring and error alerting
- The delivery kit and 30 days of support after go-live: answers and fixes on the flows built in the engagement, no new flows
Outcome. Working flows in your git, with the runbooks to keep them alive.
Operate
The Operate retainer: ten hours a month on the flows I built, no roll-over.
- After an Essential engagement, on the flows I built
- Flow maintenance when a connector, a licence or a process changes
- AI-assisted steps on your top high-volume flows
- A monthly flow-health review
- Me as your named contact, in business hours, with no response time promised
Outcome. Flows that are watched, so a break becomes a ticket.
Questions
How is this different from a one-off Power Automate engagement?
I instrument every flow, version it and assign it a named owner. The optional Operate tier keeps the flows watched: monitoring and error handling are scoped in the Statement of Work, with no set response time.
Do you cover Power Platform governance (CoE)?
Yes. A Center of Excellence baseline, environment strategy, DLP policies and ALM patterns are included when Power Platform is in scope, set up against a documented checklist in the Power Platform admin center, because Microsoft no longer actively maintains the CoE Starter Kit (Microsoft Learn, read 2026-10-29).
n8n self-hosted or cloud?
Self-hosted by default for sovereignty and cost. n8n Cloud only when the operational overhead of self-hosting is not justified by the use case. I run my own n8n instance, so I know where the trade-offs are.
Who does the work?
I do, Michal Jatczak, from the first call to the handover, so the scope you agree is the scope that gets built.
How do we leave, and what about our Zapier flows?
The transfer-out runbook is written in week one, before the first flow ships. n8n flows leave as exports in your git, and Power Platform flows through ALM. Make and Zapier are export-based: Make keeps saved scenario versions for 60 days and Zapier can roll a Zap back on its Professional, Team and Company plans (asserted, Make and Zapier documentation, read 2026-10-27), but neither history leaves with the flow, so you leave with an export and the runbook that documents each flow. I tell you that before you build on them.
Which platform do you build on, and why?
n8n, self-hosted on a server in Germany, when you want the workflow engine kept in the EU or a flow needs code or AI steps. My n8n flows are built to call Mistral's EU endpoint, but no live call has run yet. Make when the flow lives in a Microsoft 365 mailbox and you want a scenario your team can open. Its AI steps run on Make's own providers, and some of their models process in the United States even in an EU data zone, so which model and region a step uses, and whether it can stay in the EU, I confirm in writing before you commit. Power Automate when the flow stays inside Microsoft 365 and your licences already cover it. I can show flows I built on n8n and Make, and I have built none of my own in Power Automate or Zapier.
Where does the AI run, and what happens when it is wrong?
Text from outside enters an AI step as untrusted input. What comes out is checked by fixed rules for links, numbers, addresses, length and promises, and anything that fails goes to a person or is replaced by fixed text. In the flows I design, an AI step never releases a payment. Each use case above states where its AI step runs. When I work in your systems, I process personal data as your processor under the data-processing section of the Terms of Service (GDPR Art. 28), and I build and test on invented data. An AI step on your own platform account transfers data under your agreement with the platform vendor. If an AI provider I hold the contract with is to receive data from your systems, the Statement of Work names it, and I add it to the sub-processor register before any data is passed. Email my flows send goes through Resend (Plus Five Five, Inc.), which processes it in the United States under the EU-US Data Privacy Framework and the Standard Contractual Clauses (asserted, Resend DPA, read 2026-10-21). Alerts go through Telegram, outside my instance; I send no personal data of your customers through it, only a reference, a count or a status, and at most a link to my own server, where the details show only after sign-in. I do not say that all data stays in the EU.
In which languages do the flows reply and alert?
The speed-to-lead flow writes its replies, each with at most one AI-written sentence, in English and Polish, and its scoring keywords are mostly English. For every other flow, the Statement of Work names the language of its replies and alerts.
Which admin rights do you need in our tenant?
Only what a flow touches, granted to a named app registration. A flow that changes accounts, such as a leaver flow, needs a write-capable registration, so I scope it to a named group and log every call. I do not take the Global Administrator role. The Statement of Work records the access and its removal at handover or when Operate ends.
Bring one process. I map it read-only first.
Weeks 1 to 3 are read-only. You keep the ranked backlog whether or not I build anything.
Every consulting engagement ends with an Exit Kit.