Policy packs / Automation Anywhere
AA A360 Hardening
Cross-platform hardening floor for A360 bots.
Why this pack
Automation Anywhere A360 expects bots to draw credentials from the Credential Vault, log to Bot Insight, and surface every step's exception state. Flowcerta's catalog does not yet contain A360-native detectors, so this pack applies our cross-platform credential, PII, and resilience rules to A360 bot exports. The slate of A360-specific detectors will land in a follow-up release and flow into this pack automatically.
Aligned with: AA A360 Credential Vault · AA A360 Bot Insight
Environment profiles
The pack ships with severity thresholds tuned per environment so the same workflow gets stricter as it promotes toward production.
Surface findings during build without blocking the bot save.
UAT promotion gate. Highs and above block.
Strictest gate. Mediums and above block production deploys.
Rules included (10)
A360 expects all credentials through the Credential Vault — never literal in MetaBot variables.
API keys belong in Credential Vault locker entries, not in Variable Manager defaults.
A360 try/catch with empty Catch body kills the Bot Insight signal — failures are invisible.
REST Web Service actions need explicit error handling or transient outages cascade.
Bot Insight only knows what you Log to File. Missing logs = blind audit.
Bot Insight is the audit trail. Reading PII without a log event leaves a gap auditors notice.
Bot Insight retains log entries — PII written there is PII you now have to manage in Bot Insight.
Test PII left in a Variable Manager default ships with the bot to production.
Loop without exit-condition on a flaky action holds a runner queue slot forever.
A360 actions touching external systems should have an Error Handler + Retry pattern, not a raw call.