Comparison

Managed infrastructure automation vs. scripts and runbooks

Scripts and runbooks hold the know-how. What they rarely hold is the control around running them: who may run one, on which machine, with which credential, and what happened. GAEZLA keeps your scripts as playbooks and puts that control around them.

Keep the script. Change how it runs.

A playbook in GAEZLA is still your script. What changes is the path: it is signed, assigned to named agents, queued where operators can see it, and its output returns to the same record.

Keep a script where it is when its owner, credentials, targets and history already meet the need.
Keep source control and review in the repository that owns the script.
Judge the path around a script separately from the script itself.

What a standalone script leaves to you

A standalone script can be the right answer. Someone still has to decide who may run it, where its credential lives, which machines it may touch and where its output goes.

Which machines can it reach, and who decided that?
Where does its credential live, and who else can read it?
Who can start, stop or retry it, and what record is left afterwards?
If an AI wrote it, what stood between the AI and your hosts?

What GAEZLA manages

Each enrolled agent has its own identity and connects outbound. It fetches only work assigned to it, refuses unsigned work and checks the signer against the keys it trusts before anything runs.

Each run shows its state, pending, running, completed, failed or cancelled, with the output the agent returned.
Operators cancel or queue again from the same record.
Schedules run defined repeat work and keep their run history.
Quick host reads use a separate lane limited to a set list of reads. It accepts no command text.

Where the AI fits

The AI can write a playbook, but only as a proposal. It reaches an agent only after an operator approves that exact content.

The proposal carries its reason and evidence from the same case, and it is fingerprinted at approval.
Approve and execute refuse machine tokens, and nothing in GAEZLA can approve a proposal.
A job that needs a secret gets it sealed to the one Linux host that runs it, after approval. The AI sees names and labels only.

Remediation keeps its own record

A scanner finding, a proposed change and an executed change are different records in GAEZLA. Each keeps its own state, so a recommendation is never shown as a completed change.

Recommending or running a change does not close a finding. It is marked resolved when a later scan from that scanner no longer reports it.
A hardening change runs only where the benchmark supports it, and records for each setting what it was, what the benchmark requires and what it is now, with the outcome and any verification error.
A change the AI drafts from an investigation runs only after an operator approves it, with multi-factor authentication if you require it.

Related operating models.

Next step

Compare it with the path you operate today.

Thirty minutes, no slide deck: bring one real incident and see what the AI reads, what it proposes, who approves it and what gets recorded. Or start a trial and run it on your own estate.

Book a walkthrough Start a trial