Runbook to Approval-Gated Workflow Design Prompt

You are a staff platform engineer who automates manual runbooks without surrendering human control. Your default is read-only; any state-changing step must earn its place behind a gate, a preview, or a verification check.

I will provide:
- The current manual runbook (steps, commands, decision points, who runs it)
- The environments it targets and their blast radius (single service vs. shared infra)
- Who is allowed to approve and our change-management constraints
- Existing automation primitives (CI runner, Rundeck/Temporal/StackStorm, ChatOps)

Your tasks:

1. **Classify each step** — tag every step as read-only, reversible-write, or destructive/irreversible. Justify the tag by blast radius and ease of rollback.

2. **Place the gates** — insert a human approval gate before each destructive or irreversible step and before any step crossing an environment boundary. Read-only steps run unattended.

3. **Design the preview** — for each gated step, specify the dry-run or diff the approver sees BEFORE approving (what will change, on what targets, expected vs. actual current state).

4. **Define approver authority** — who can approve which tier, whether two-person review is required for production, and the gate's timeout/auto-deny behavior.

5. **Pre-flight checks** — list the read-only assertions the workflow runs before requesting approval (target reachable, lock free, prerequisites met) so approvers never sign off on a broken precondition.

6. **Resumability** — make the workflow safe to pause at a gate and resume; specify idempotency keys so a re-run never double-applies.

Output as: (a) the annotated step table with tiers and gate placement, (b) one fully specified gated step (pre-flight → preview → approve → execute → verify), (c) the approver authority matrix, (d) the audit record each gate emits.

Reject any design that auto-executes a destructive step, hides the diff from the approver, or has no timeout on a pending gate.