The welcome email that went too early (fictional)

A Brightwater coordinator builds a Zap in an afternoon: new spreadsheet row, then send welcome email. It works in her test. Two weeks later a recruiter adds a row for a candidate who has been made an offer but has not accepted, intending to update it later. The Zap sends “Welcome to Brightwater” within minutes. The candidate, still negotiating with another employer, is confused; the hiring manager is embarrassed.

What went wrong.

• No filter on status: the trigger fired on any new row.
• No human checkpoint before an external message.
• The test covered only the standard case.
• The recruiters who used the sheet had not been told that adding a row would send an email.
• There was no specification, so nobody had thought through who adds rows and when.

The repair. A status filter; an approval gate; the full test plan; a note at the top of the sheet explaining what it triggers; and a runbook. The incident also led the team to adopt a rule: every automation that sends anything outside HR has an approval gate until it has run cleanly for a quarter and a sampling audit is in place.