A trader who won’t define a stop-loss before entering a position isn’t trading; he’s gambling with extra steps. The same test applies to automated jobs. A script that runs unattended with no owner, no cap and no kill switch is a position with unlimited downside — and unlike a trade, it can keep losing on nights and weekends. The discipline that fixes this is AutomationOps, specified at length by The Ops Atlas: choosing automated actions deliberately, engineering the repeats to be safe, capping the damage of a bad run, and owning every job until retirement. What follows is a working audit you can run against your desk’s automation this week. No tooling purchases required. Score each check pass or fail; the fails are your risk register.

The Ten-Point AutomationOps Audit

1. Named owner per job. Every scheduled action has one accountable person — a name, not a team alias. If the owner left and nobody replaced them, the job is unowned and the check fails.
2. Registry, not folklore. The full list of automated jobs lives in one reviewed place: what each job does, the targets it is allowed to reach, the identity it runs under, when it was last reviewed. If the list exists only in someone’s head, fail.
3. Preview before acting. Every job can print what it intends to do without doing it. Caveat worth flagging in the audit notes: some check modes skip raw shell lines, so confirm the preview actually exercises the dangerous commands.
4. Empty means stop. A job whose target list comes back blank halts and alerts — never proceeds as if “nothing” meant “everything”. This single guard has prevented catastrophic mass deletions in production environments; its absence has caused them.
5. Batches with a pilot. Fleet-wide changes roll out one pilot machine first, then small cohorts, with a health check between cohorts. All-at-once across every server is an automatic fail, whatever the urgency.
6. Self-stopping runs. A job quits after a small, pre-agreed number of failures and calls a person. A loop that will grind through a hundred broken targets because you told it to iterate is a liability, not diligence.
7. A halt that has been pulled. Each job stops on command; a global stop sits above all jobs; and both are drilled on a schedule. The on-duty engineer holds standing authority to pull them without clearing it upward. An untested brake is a hypothesis.
8. Scoped identities. Jobs run under individual, least-privilege accounts. One shared login with broad rights — the classic god credential — fails instantly, no partial credit.
9. Repeats are safe by construction. Jobs declare a desired state so reruns are no-ops. Where a one-time gesture is unavoidable — a fund transfer, an order, a notification — the caller carries a unique request reference recorded on arrival, and duplicates get refused.
10. Destructive jobs are gated. Anything that erases data or can’t be reversed requires a second person’s explicit approval, prefers soft deletion, and rolls out in stages.

Scoring the Audit Without Fooling Yourself

Grade strictly: a check passes only when you can demonstrate it, not when you believe it. An owner nobody has contacted in a year is not an owner. A halt that has never been pulled is a rumor. A preview that skips the risky lines is theatre. Most first-time audits come back with six or seven fails out of ten, and that’s normal — the point of the exercise is that the fails are specific, cheap to describe, and mostly fixable with configuration and paperwork rather than new spending. Rank the fixes by what failure costs, not by how easy they are: destructive-reach problems first, identity problems second, everything else after. That ranking is the automation equivalent of sizing positions by risk rather than by reward, and it’s the same instinct behind the risk-reward framework you’d apply to any trade — cut the tail risk before you chase the upside.

Findings You Should Expect on the First Pass

So you don’t panic at your own scorecard, here are the usual suspects — the anti-patterns the Atlas catalogues, translated into desk language:

• The desk drawer position. Jobs living in personal home folders, running on inherited permissions. When the author leaves, you hold a position you can’t see the terms of.
• Approval inflation. Requiring sign-off on every little run until approvers start rubber-stamping from muscle memory. Fatigued approval is no approval; gate by risk grade instead.
• Self-healing that hides the wound. Auto-remediation quietly papering over a failing component so nobody fixes the underlying defect — until the remediation itself saturates.
• The “done” trade. Treating automation as a one-time project. Jobs rot as platforms and APIs move; unscheduled reviews mean unnoticed drift.

Every one of these is a habit problem before it’s a technology problem, which is good news: habits are free to change.

The Case Every Desk Should Know Cold

The canonical story is from 2012, and it deserves its place on the syllabus next to every blown-up account in market history. An American trading firm deployed new code with parts of the old system still live, and nobody had reviewed what would actually execute. The stray logic spent the morning buying shares at volumes and prices no human intended. In roughly forty-five minutes the firm was out an estimated 460 million dollars — enough to erase the company. No hacker, no exotic market event. The cause was one automated action, live in production, carrying content nobody had reviewed, with no gate in front of it and no working brake behind it. Scale that shape down and it’s every runaway batch job that has ever re-sent a client file, double-executed an order flow, or re-run a settlement export. The lesson isn’t “avoid automation” — desks that refuse automation lose to desks that master it. The lesson is that unreviewed reach is a short position on your own infrastructure, and you don’t get to pick when it gets called.

The AutomationOps Payback Arithmetic, Done Honestly

Automation budgets deserve the same skepticism you’d apply to a backtest. The honest metric is net hours returned: how often the job runs, times the minutes of manual work it actually replaces, minus its maintenance cost, converted to hours. One worked example from the Atlas’s model: forty runs a month replacing about twenty minutes each nets 7.83 hours monthly once upkeep is paid; the build breaks even at 5.1 months; the run success rate sits at ninety-five percent, with failures stopping safely rather than limping on. Track three more numbers alongside: how often the guards trip (small but nonzero is healthy), how often an automated action is itself the root cause of an incident, and what share of jobs have live owners. Guard trips at zero usually mean the guards are disconnected, the same way a system that never shows losses usually means the risk isn’t being measured.

A 90-Day Plan That Doesn’t Fantasy-Project

Keep it boring and sequenced, the way disciplined traders actually operate. Days 1–30: run the audit, register the twenty riskiest jobs, kill or quarantine the orphans. Days 31–60: consolidate onto one runner, issue scoped identities, and pull every halt once on purpose so you know the stop story is true. Days 61–90: put the registry under review like code, wire approvals to risk grades, and push owner coverage past ninety percent. Most organisations stall one step before this — scripts shared in a repository, no owners, one shared credential — which is the maturity level the Atlas flags as the industry’s most common plateau. Escaping it is unglamorous: names, dates, and a calendar. The psychology, though, is the same one behind trader psychology: the discipline is boring precisely because it works, and skipping it feels free right up until the tail event. And if you want the same mindset applied to execution habits themselves, the step-by-step work in taking control of your trades maps almost one-to-one onto governing automated jobs: define the limits before you start, measure what actually happened, and review on a schedule you don’t negotiate with. Errors don’t disappear when you automate; they move upstream to design time, where they’re quieter and repeat faster. Audit accordingly.