Safety: what an automation can and cannot do

Automations can only perform the operations built into the system, only work with your own company's data, and can only be created or changed by users with the manage permission.

Who can manage them? The Flows menu item and the automations themselves are only available to users with the manage permission for the Automation module.

What can an automation do? Only the actions on the list: creating a project or task, assigning a user, sending a notification, creating an invoice draft, requesting approval, calling a webhook, and escalating. You cannot run custom program code in it.

Built-in limits:

• An automation only works with your own company's data; only your company's users can be notified or assigned.
• It does not issue invoices: at most it creates an invoice draft, which you review and issue.
• The approval action only starts the approval – a person still makes the decision.
• An incomplete process (no trigger, no event, no action, or an unfinished condition branch) cannot be activated.
• Webhooks can only be sent to public internet addresses, not to internal network addresses.

Good practice: for webhooks to external systems and notifications that reach many people, think about what data goes out and to whom. Use conditions to narrow runs down to the cases that really need them, and try the automation with Test Run before activating it.