Before moving from Decide into an automated Act operation, the workflow should determine whether the targeted asset, identity, account, or service is subject to an exemption . This represents an essential safety control for security automation.

The OODA model progresses from observation of an event, through contextual orientation and decision-making, toward action. The final transition can produce consequential operations such as disabling an account, isolating an endpoint, blocking an address, revoking credentials, or modifying infrastructure. Performing those actions without checking exemptions can create significant business impact.

For example, automatically disabling a service account responsible for production authentication could cause an outage even though the detection itself was technically accurate. Exemption logic allows security engineers to establish guardrails for privileged systems, break-glass accounts, infrastructure services, executive assets, approved scanners, and other protected entities.

Creating a playbook or response template defines how automation is implemented, but neither substitutes for the decision guardrail immediately before execution. Effective security automation therefore combines machine-speed response with explicit environmental constraints.

The OODA automation question is presented on page 2 of the supplied certification material.

Study Guide topics: OODA, SOAR automation, automation guardrails, asset/identity exemptions, response safety, automated remediation.