Act safely, with guardrails built in
Start, stop, resize, back up, patch and schedule from the same screen where you found the problem. A person always starts the action, a second can approve it, and every step is audited.
Every action follows the same six rules
A person starts it
Nothing runs because a rule fired or a model suggested it. Running an action needs the operation permission and MFA.
A second person can approve it
Approval rules by action, environment and criticality. A requester can never approve their own request.
Every step is audited
Each request, approval, refusal and result lands in the append-only audit log.
A separate, opt-in policy
Operations need their own OCI policy, each statement narrowed to the one action it allows. Collection stays read-only.
Switched on per connection
An administrator turns operations on for each connection. Licensed under the Operations module.
Deterministic calls
Every action is a plain OCI SDK call. No AI, no shell, no scripts in between.
What VIREOPS can do in your cloud
Live means running on our demo estate with real OCI resources. Built means built and tested, not yet exercised live.
| Action | Detail | Status |
|---|---|---|
| Instance start, stop, reboot | Graceful stop and graceful reboot | Live |
| Resize a flexible shape | Now, or in a maintenance window | Live |
| Boot and block volume backup | Full or incremental | Live |
| Copy the latest backup to another region | For a DR copy | Live |
| Assign an Oracle backup policy | Never replaces an existing policy | Built |
| Autonomous Database start and stop | And longer backup retention, only ever longer | Live |
| Autonomous Database manual backup | Built | |
| DB system and MySQL HeatWave start and stop | Built | |
| DB system automatic backups on | Never off, never shorter | Built |
| OS updates | Through OS Management Hub: security, bug fixes or all | Live |
| Launch an instance | Shapes, images and fault domains read live; OS time zone | Live |
| Schedule hooks | Call your OCI Function before stop and after start; a failing before-stop keeps the instances running | Built |
| Governed tags | Write vireops defined tags: application, environment, criticality, owner | Live |
| Operations on AWS | AWS stays read-only | Not yet |
Launch with the facts already filled in
Shapes, images and fault domains are read live from your tenancy, into a compartment and subnet VIREOPS has already collected.
- OS updates through OS Management Hub, choosing security updates, bug fixes or everything. In testing, one run installed 214 security updates on a VM.
- Bulk actions run one operation per resource. Each is validated and audited on its own, and refusals are listed with the reason.
Four eyes where it matters
Decide which actions need a second person, by action, environment and criticality. A production resize can need two approvals while a dev reboot needs none.
- One or two approvals per rule.
- No self-approval: a requester can never approve their own request.
- Expiry: unapproved requests expire after 24 hours by default.
- Batch approval for a queue of related requests.
- Notified: approvals waiting appear in the bell and, once email is set up, within a minute by email.
Start and stop on your calendar, not ours
Turn non-production off outside business hours and see the saving, estimated from each instance's own compute cost.
- By time zone and weekday, with daylight saving handled correctly.
- Target chosen resources, a tag such as
env=dev, or an application, resolved again at every run. - Holiday calendars, and one-off skip, postpone or restore.
- Missed runs are recorded and never run late.
- Protected resources: anything tagged
vireops-protected=trueis always skipped.
Tags that mean something, written safely
Give every resource an application, environment, criticality and owner. Those tags drive schedules, approval rules and reports.
- Only
vireopskeys change. Other namespaces and freeform tags are kept exactly. - VIREOPS never removes a tag.
- Drift is shown as "Differs" and can be put back.
- "Written to OCI" shows until the next collection confirms the change.
Questions about cloud actions
Does turning on actions change the read-only collection?
No. Collection keeps its own read-only policy. Operations need a separate, opt-in OCI policy with each statement narrowed to one action, and an administrator turns them on per connection.
Can AI run an action?
No. AI never holds the write permission. A person always starts an action, and Ask VIREOPS has no write tools at all.
What stops someone approving their own change?
The approval engine. A requester can never approve their own request, running and approving both need MFA, and both are separate permissions held by different roles.
Can VIREOPS delete or terminate resources?
No. VIREOPS never deletes, terminates or detaches anything, and backup settings only ever get longer, never shorter or off.
Are actions available for AWS?
Not yet. The AWS connector is read-only; cloud actions are OCI only today.
Let's map your cloud estate together.
See VIREOPS on a live OCI estate: scored, priced and evidenced in one walkthrough. NotionAce deploys it in your tenancy within days.