Skill ממשל ותאימות לאוטומציות ל-Claude

מתי להשתמש

"Governance", "Change management", "SOC 2", "GDPR", "Access control", "Approvals".

הוראות עבודה

1. Why Governance

5 workflows = OK to wing it. 50 workflows = chaos without governance.

2. Pillars

א. Change Management

• Who can modify production workflows?
• Approval process for changes?
• Testing requirements before deploy?

ב. Access Control

• Who has admin / edit / view access?
• Role-based permissions.
• Reviewed quarterly.

ג. Environments

• Dev → Staging → Prod separation.
• Test risky changes first.

ד. Compliance

• SOC 2 (B2B SaaS).
• GDPR (EU customers).
• HIPAA (healthcare).
• PPL (Israeli Privacy Law).

ה. Audit

• Periodic review of workflows.
• Compliance verification.

3. Change Management Process

Light (Small Org)

1. Build in dev/staging.
2. Test.
3. Deploy to prod.
4. Document change.

Medium (Mid-size)

1. Propose change (1-line description in Slack).
2. Build + test.
3. Peer review.
4. Deploy.
5. Document.

Heavy (Enterprise)

1. Change ticket (Jira/ServiceNow).
2. Risk assessment.
3. Approval (CAB — Change Advisory Board).
4. Build in dev.
5. Test in staging.
6. Deploy in maintenance window.
7. Verify.
8. Document.
9. Post-deploy review.

4. Environments

Why Separate

• Test without affecting customers.
• Failures contained.
• Compare dev vs prod data.

How

• Separate Zapier/Make accounts.
• Salesforce Sandbox for SF workflows.
• HubSpot Sandbox (Enterprise).

Workflow Promotion

• Build in dev.
• Test thoroughly.
• Export → Import in staging.
• Test again.
• Promote to prod.

5. Access Control (RBAC)

Roles

• Admin: full access (1-2 people).
• Editor: create/modify (5-10).
• Viewer: read-only (broader).

Per-Workflow Ownership

• Each workflow has primary + backup owner.
• Only owners can modify.

Quarterly Review

• Remove offboarded employees.
• Audit access lists.

6. SOC 2 Compliance

Trust Service Criteria

• Security: Access controls, encryption.
• Availability: Uptime SLOs.
• Confidentiality: Data classification.
• Privacy: PII handling.
• Processing Integrity: Data accuracy.

Automation Implications

• Audit logs required.
• Change management documented.
• Access reviews quarterly.
• Incident response process.
• Vendor (Zapier/Make) DPAs.

7. GDPR Compliance

Key Requirements

• Data minimization — only what's needed.
• Lawful basis — consent / contract / etc.
• Right to erasure — automated deletion workflow.
• Right to access — data export.
• DPO if processing scale large.
• DPIA for high-risk processing.

Tool DPAs

• Zapier, Make, n8n provide DPAs.
• HubSpot, Salesforce etc.

8. Israeli PPL (חוק הגנת הפרטיות)

Amendment 13 (2024-2025)

• Stricter than before.
• רישום מאגר מידע (Database registration).
• DPO in some cases.
• Breach notification within 72 hours.
• Fines up to ₪320K+.

9. HIPAA Compliance (Healthcare)

Critical

• BAA (Business Associate Agreement) with vendors.
• Encryption at rest + in transit.
• Access logs detailed.
• Audit trail retention 6 years.

10. Audit Checklist (Quarterly)

• All workflows documented.
• Owners current (no offboarded).
• Access lists reviewed.
• API keys rotated last 90 days.
• OAuth tokens valid.
• Failed workflows root-caused.
• Cost trends reviewed.
• Security incidents reviewed.
• Compliance status verified.

11. Common Pitfalls

❌ Single person owns all workflows — bus factor 1. ❌ No staging environment — break prod. ❌ No access reviews — ex-employees still access. ❌ No DPAs — GDPR violation. ❌ No incident response plan — chaos when breach.

12. Israel Specifics

• PPL Amendment 13 — major changes 2024-2025.
• Israeli Privacy Authority active.
• Defense industry — special compliance.
• Hebrew docs for legal compliance.

13. אסיים בהמלצה.

קלט נדרש

פלט צפוי

דגלים אדומים

• 🚨 Single owner all workflows — bus factor.
• 🚨 No environments — breaking prod.
• 🚨 No quarterly review — stale access.
• 🚨 No DPAs — compliance violation.

הערות חשובות

• Compliance != one-time — ongoing.
• Documentation = compliance — proof.
• Israeli PPL Amendment 13 — major change, study it.

פרומפט לדוגמה

Israeli SaaS, SOC 2 prep. Automation-related controls.

50 workflows, no governance. תכנון.

PPL Amendment 13 — automation implications.

© 2026 Automation Expert Pro | גרסה 1.0.0