live wire
▸AI · Red Hat documents usage-based admission fair sharing for Kueue 1.4 on OpenShiftRed Hat Developer▸AI: Red Hat maps governed firewall changes from ServiceNow through Ansible and two human approval gatesRed Hat Developer▸CLUSTER MGMT · ACM 2.17 makes Submariner 0.24 GA with Important-rated fixesRed Hat Errata▸PLATFORM · Red Hat makes on-premises Lightspeed recommendations GA for Satellite 6.18Red Hat Errata▸SECURITY · Red Hat Hardened Images updates Tomcat 10 for nine authentication, access-control and DoS flawsRed Hat Errata▸AI · Open Data Hub 3.6.0 EA1 bundles Trainer, MLflow and llm-d componentsOpen Data Hub▸AI · Speculators 0.6.0 adds P-EAGLE parallel drafting for vLLM speculative decodingRed Hat Developer▸SECURITY · OpenShift 4.17.57 fixes seven Go and TLS CVEs in an Important-rated updateRed Hat Errata▸AI · Red Hat benchmarks local LLM guardrails with EvalHub, exposing regex accuracy and latency trade-offsRed Hat Developer▸AI · Red Hat maps silent tool-call failures across agentic pipelinesRed Hat▸API · Kuadrant 1.5.3 adds GRPCRoute policies and developer-portal API-key workflowsKuadrant▸AI · (Aug 25) IBM releases Apache-2.0 Granite 4.2 reasoning models in 3B, 8B and 30B sizesIBM Research▸JAVA · Red Hat build of Quarkus 3.33.3.SP1 fixes 13 CVEs in an Important-rated updateRed Hat errata▸AI · vLLM moves Kimi K2 RL weight sync across 384 H100s in 7.53 seconds (Aug 22)vLLM▸AI · Red Hat documents usage-based admission fair sharing for Kueue 1.4 on OpenShiftRed Hat Developer▸AI: Red Hat maps governed firewall changes from ServiceNow through Ansible and two human approval gatesRed Hat Developer▸CLUSTER MGMT · ACM 2.17 makes Submariner 0.24 GA with Important-rated fixesRed Hat Errata▸PLATFORM · Red Hat makes on-premises Lightspeed recommendations GA for Satellite 6.18Red Hat Errata▸SECURITY · Red Hat Hardened Images updates Tomcat 10 for nine authentication, access-control and DoS flawsRed Hat Errata▸AI · Open Data Hub 3.6.0 EA1 bundles Trainer, MLflow and llm-d componentsOpen Data Hub▸AI · Speculators 0.6.0 adds P-EAGLE parallel drafting for vLLM speculative decodingRed Hat Developer▸SECURITY · OpenShift 4.17.57 fixes seven Go and TLS CVEs in an Important-rated updateRed Hat Errata▸AI · Red Hat benchmarks local LLM guardrails with EvalHub, exposing regex accuracy and latency trade-offsRed Hat Developer▸AI · Red Hat maps silent tool-call failures across agentic pipelinesRed Hat▸API · Kuadrant 1.5.3 adds GRPCRoute policies and developer-portal API-key workflowsKuadrant▸AI · (Aug 25) IBM releases Apache-2.0 Granite 4.2 reasoning models in 3B, 8B and 30B sizesIBM Research▸JAVA · Red Hat build of Quarkus 3.33.3.SP1 fixes 13 CVEs in an Important-rated updateRed Hat errata▸AI · vLLM moves Kimi K2 RL weight sync across 384 H100s in 7.53 seconds (Aug 22)vLLM
upstreambeat.ai
analysisAI

Red Hat maps a governed path from AI firewall analysis to Ansible execution

The reference workflow keeps the model away from credentials and devices, putting Git and ServiceNow approvals between proposed rules and deployment.

Workflow from request to approval to Ansible deployment.
AI-generated diagram
By The News Desk· Sep 4, 2026

Red Hat has published a reference workflow that uses a large language model to analyze firewall-change requests while reserving execution for Ansible Automation Platform. The worked example starts with a ServiceNow connectivity request, uses the model to trace the network path and propose rules, and requires two human approvals before Ansible deploys anything (Red Hat Developer).

The distinction matters. In Red Hat's design, the model neither connects to network devices nor receives their credentials. It returns structured recommendations and supporting rationale; deterministic Ansible rulebooks, playbooks and modules handle validation, state transitions and execution. Secrets stay in Ansible Automation Platform and are injected only at runtime (Red Hat Developer).

Approval is part of the architecture

Event-Driven Ansible listens for ServiceNow requests and Git pull-request updates. A new ticket starts a drift check against live Palo Alto Networks firewalls, followed by model-assisted path analysis and a pull request containing the proposed configuration. An engineer must approve that pull request before Ansible creates a ServiceNow change record; a Change Advisory Board approval is then required before deployment (Red Hat Developer).

Git records the intended configuration in structured host_vars data. The main branch represents the last successfully deployed state, while the pull request represents the proposed next state. If the live configuration has drifted from Git, the workflow stops rather than applying a change from an untrusted baseline (reference implementation).

The model proposes; automation decides whether to proceed

The accompanying Containerlab demo includes two Palo Alto VM-Series firewalls, an Arista cEOS router and two Linux containers. Its cases test partial rule coverage, no existing coverage and an unresolvable request. In the last case, the requested port has no defined Palo Alto application ID, so the workflow stops and posts an explanation to ServiceNow instead of inventing or deploying a rule (reference implementation).

This is not a claim that probabilistic analysis has become safe infrastructure execution. It is a concrete pattern for containing that uncertainty: constrain model output to proposals, preserve the desired state in Git, check for drift, require explicit approvals and leave privileged execution to established automation. For platform and network teams experimenting with operational AI, those boundaries are the most useful part of the design.

sources

Filed by The News Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk