Autopilot and autonomy
What Veriom sets up for you when you connect a repository, what it can do on its own once an Admin allows it, and what always waits for a person.
This page is for the workspace Admin who decides how much Veriom does by itself. Autopilot sets up audits for you when you connect code. Autonomy lets Veriom approve some low-risk work without waiting for a person. Some decisions always stay with a person.
Autopilot: audits set up for you
Autopilot is on by default. When you connect a repository, Veriom creates:
| What | Details |
|---|---|
| A first audit | One per repository or uploaded ZIP |
| A Weekly audit schedule | Monday at 09:00 UTC |
| A Default branch changes trigger | Audits each push and merged pull request on the default branch. GitHub, GitLab, and Bitbucket |
These show a Default badge under Audits → Schedules. Edit, pause, or remove them like any schedule you made yourself.
Autopilot only starts audits. It never approves, merges, or publishes anything.
Autonomy: let Veriom approve low-risk work
Autonomy is off until an Admin turns it on. It has four rules:
| Rule | What Veriom does on its own | Default limits |
|---|---|---|
| Prepare fixes after each audit | Writes and verifies fix patches for serious findings, ready for review | Up to 3 per audit, for high and critical findings |
| Approve verified fixes | Approves small, verified fixes and opens a draft pull request | Low severity only, at most 3 files and 40 lines, only in source folders you allow. The draft pull request opens after a 30-minute hold, during which you can withdraw it |
| Run held audits | Starts audits that a GitHub event policy held for approval | Only for the branches and people you trust, up to 10 a day. A running audit is never cancelled |
| Accept discovery suggestions | Accepts boundary suggestions | Only with 90% confidence or more. Sensitive fields still wait for a person |
Turn it on
- Open Settings and select Automation.
- In the Autonomy card, review the recommendation. Veriom builds it from your workspace, for example which source folders fixes may touch.
- Click Enable recommended automation and confirm with your passkey or password.
The card then shows Automation is on. When Veriom has a newer recommendation, the card shows On · update ready. Click Apply the updated recommendation to use it.
To stop it, click Pause automation. Every decision waits for a person again, and Veriom keeps your rules. Click Turn automation back on to resume.
You need the Admin or Owner role.
Always yours
These decisions always need a person. No setting changes that:
- merging a pull request into your repository;
- accepting a risk on a finding;
- compliance exceptions and publishing compliance libraries;
- promoting anything to production;
- qualifying a new AI model;
- publishing discovery profiles and taxonomy snapshots;
- attesting a report.
The Always yours section of the Autonomy card shows the same list.
See what Veriom did on its own
Open the Activity panel from the header and turn on Automation only. Each item shows where it came from, such as Autopilot or Schedule, and events such as Fix approved automatically.
The Activity log under Settings keeps a permanent record. See Activity log.
Was this guide useful?
Your response stays in this browser unless you open a GitHub issue.