# AI連携・自動化ツール大全

CURRENT_STATUS: CURRENT
OBSERVATION: SPEC_ONLY
FRESHNESS: CURRENT
PAGE_TYPE: reference
CANONICAL_URL: /tools/ea-007-ai
CLAIM_IDS: none
EVIDENCE_IDS: EVD-EA-007-URL-DFF9F0B77CE3, EVD-EA-007-URL-A8CC9B75373A, EVD-EA-007-URL-7E62C1A216B2, EVD-EA-007-URL-8FDC314E3DB3, EVD-EA-007-URL-9DC78DB62D36, EVD-EA-007-URL-F1918555434F, EVD-EA-007-URL-F7A5074EDB87, EVD-EA-007-URL-65F23DD9C265, EVD-EA-007-URL-3C2553D5AC2C, EVD-EA-007-URL-DED547B9FD1B, EVD-EA-007-URL-A054067438DF, EVD-EA-007-URL-3B6EA6913663, EVD-EA-007-URL-91D9CAD733D6, EVD-EA-007-URL-1D570AA42956, EVD-EA-007-URL-FBB961B10892, EVD-EA-007-URL-BD1F28A85D86, EVD-EA-007-URL-55422519A0A3, EVD-EA-007-URL-7D4C03F2D024, EVD-EA-007-URL-6D776225A051, EVD-EA-007-URL-D423BB6A2D7C, EVD-EA-007-URL-191C4FA0BC31, EVD-EA-007-URL-9FFB7F304DAC, EVD-EA-007-URL-9469FE5D5C92, EVD-EA-007-URL-BB03F4E0C827, EA-007-CURRENT-APPROVAL, EA-007-CURRENT-BODY-READBACK
UNKNOWN_IDS: EA-007-UNKNOWN-01, EA-007-UNKNOWN-02
OPS_IDS: none

## Summary
Treat workflow automation as an execution and authority boundary. Record credential owner, trigger, connector/action version, side-effect class, retry/idempotency contract, DLP/policy scope, execution evidence, audit retention, and rollback path rather than comparing products by connector count alone.

## Current judgment
- Current automation products continue to expose materially different retry, execution-history, audit-log, licensing, and policy surfaces; “has a connector” is not a sufficient enterprise comparison axis.
- n8n documents replay/retry of failed executions with original or current workflow definitions.
- Make documents an explicit Retry error handler and plan-dependent audit/webhook retention.
- Power Automate documentation separates connector/DLP policy, licensing/capacity, and execution rights.
- The canonical packet's credential, side-effect, idempotency, retry, audit, and change-control axes remain current.

## Scope
AI連携・自動化ツール大全

## Confirmed
- Current automation products continue to expose materially different retry, execution-history, audit-log, licensing, and policy surfaces; “has a connector” is not a sufficient enterprise comparison axis.
- n8n documents replay/retry of failed executions with original or current workflow definitions.
- Make documents an explicit Retry error handler and plan-dependent audit/webhook retention.
- Power Automate documentation separates connector/DLP policy, licensing/capacity, and execution rights.
- The canonical packet's credential, side-effect, idempotency, retry, audit, and change-control axes remain current.

## UNKNOWN
- EA-007-UNKNOWN-01: - Zapier/Make/n8n/Power Automate/UiPath間で、同一fixtureを使ったvendor-neutralなside-effect/retry比較は未実施。
- 各製品の全connectorについてidempotency保証を一括確認することは不可能であり、重要action単位で確認が必要。
- ChatGPT Plugin directory移行後の各pluginのaction approval・audit granularityはplugin/app固有で、共通保証として閉じない。
- SaaS各社のprivate networking/data residency/log retentionはplan・regionで変動するため個別matrix作成時に再確認。
- EA-007-UNKNOWN-02: - exact current retry/backoff/idempotency behavior for every connector and product;
- organization-specific plan entitlements and audit-retention overrides;
- cross-product semantics for replay after workflow edits;
- downstream SaaS object-level authorization and irreversible side effects.

## Evidence
- EVD-EA-007-URL-DFF9F0B77CE3 (RESEARCH): - AUTHOR/ORG: Microsoft — https://learn.microsoft.com/en-us/power-platform/guidance/adoption/dlp-strategy
- EVD-EA-007-URL-A8CC9B75373A (RESEARCH): URL: https://learn.microsoft.com/en-us/power-platform/guidance/adoption/dlp-strategy ; — https://learn.microsoft.com/en-us/microsoft-copilot-studio/admin-data-loss-prevention
- EVD-EA-007-URL-7E62C1A216B2 (RESEARCH): - AUTHOR/ORG: Microsoft — https://learn.microsoft.com/en-us/power-automate/limits-and-config
- EVD-EA-007-URL-8FDC314E3DB3 (RESEARCH): URL: https://learn.microsoft.com/en-us/power-automate/limits-and-config ; — https://learn.microsoft.com/en-us/power-automate/how-tos-bulk-resubmit
- EVD-EA-007-URL-9DC78DB62D36 (RESEARCH): - AUTHOR/ORG: n8n — https://docs.n8n.io/hosting/securing/security-audit/
- EVD-EA-007-URL-F1918555434F (RESEARCH): URL: https://docs.n8n.io/hosting/securing/security-audit/ ; — https://docs.n8n.io/workflows/executions/all-executions/
- EVD-EA-007-URL-F7A5074EDB87 (RESEARCH): URL: https://docs.n8n.io/hosting/securing/security-audit/ ; https://docs.n8n.io/workflows/executions/all-executions/ ; — https://docs.n8n.io/source-control-environments/create-environments/
- EVD-EA-007-URL-65F23DD9C265 (RESEARCH): - AUTHOR/ORG: Make — https://help.make.com/audit-logs
- EVD-EA-007-URL-3C2553D5AC2C (RESEARCH): URL: https://help.make.com/audit-logs ; — https://help.make.com/credential-requests
- EVD-EA-007-URL-DED547B9FD1B (RESEARCH): URL: https://help.make.com/audit-logs ; https://help.make.com/credential-requests ; — https://help.make.com/okta-saml
- EVD-EA-007-URL-A054067438DF (RESEARCH): - AUTHOR/ORG: Zapier — https://help.zapier.com/hc/en-us/articles/8496279747085-Set-up-single-sign-on-with-SAML
- EVD-EA-007-URL-3B6EA6913663 (RESEARCH): URL: https://help.zapier.com/hc/en-us/articles/8496279747085-Set-up-single-sign-on-with-SAML ; — https://help.zapier.com/hc/en-us/articles/43996004782349-Allowed-domains-for-app-connections
- EVD-EA-007-URL-91D9CAD733D6 (RESEARCH): URL: https://help.zapier.com/hc/en-us/articles/8496279747085-Set-up-single-sign-on-with-SAML ; https://help.zapier.com/hc/en-us/articles/43996004782349-Allowed-domains-for-app-conn — https://zapier.com/security-compliance
- EVD-EA-007-URL-1D570AA42956 (RESEARCH): - AUTHOR/ORG: Google — https://developers.google.com/workspace/add-ons/how-tos/building-workspace-addons
- EVD-EA-007-URL-FBB961B10892 (RESEARCH): URL: https://developers.google.com/workspace/add-ons/how-tos/building-workspace-addons ; — https://developers.google.com/apps-script/guides/support/troubleshooting
- EVD-EA-007-URL-BD1F28A85D86 (RESEARCH): - AUTHOR/ORG: UiPath — https://docs.uipath.com/automation-cloud/automation-cloud/latest/admin-guide/about-logs
- EVD-EA-007-URL-55422519A0A3 (RESEARCH): URL: https://docs.uipath.com/automation-cloud/automation-cloud/latest/admin-guide/about-logs ; — https://docs.uipath.com/automation-cloud/automation-cloud/latest/api-guide/audit-logs
- EVD-EA-007-URL-7D4C03F2D024 (RESEARCH): - AUTHOR/ORG: OpenAPI Initiative / Linux Foundation — https://spec.openapis.org/oas/v3.2.0.html
- EVD-EA-007-URL-6D776225A051 (RESEARCH): - AUTHOR/ORG: OpenAI — https://help.openai.com/en/articles/11487775-connectors-in-chatgpt
- EVD-EA-007-URL-D423BB6A2D7C (RESEARCH): https://help.make.com/retry-error-handler — https://help.make.com/retry-error-handler
- EVD-EA-007-URL-191C4FA0BC31 (RESEARCH): https://help.make.com/webhooks — https://help.make.com/webhooks
- EVD-EA-007-URL-9FFB7F304DAC (RESEARCH): https://learn.microsoft.com/power-automate/prevent-data-loss — https://learn.microsoft.com/power-automate/prevent-data-loss
- EVD-EA-007-URL-9469FE5D5C92 (RESEARCH): https://learn.microsoft.com/en-us/power-platform/admin/power-automate-licensing/types — https://learn.microsoft.com/en-us/power-platform/admin/power-automate-licensing/types
- EVD-EA-007-URL-BB03F4E0C827 (RESEARCH): https://learn.microsoft.com/en-us/power-platform/admin/governance-considerations — https://learn.microsoft.com/en-us/power-platform/admin/governance-considerations
- EA-007-CURRENT-APPROVAL (RESEARCH): 現行本文の監査・revision対応
- EA-007-CURRENT-BODY-READBACK (IMPL): 現行本文の収録照合

## Failure / limits
EA-007の更新着手に必要な共通分類、代表実装、主要governance axis、failure envelope、評価profileが揃ったためbounded close。製品別全機能カタログ化は後続Workへ送る。
## Failure / limits
Connector count does not prove authorization quality, delivery guarantees, idempotency, rollback, or audit completeness.
## Failure / limits
Retry can duplicate non-idempotent side effects when the downstream system lacks a stable idempotency contract.
## Failure / limits
Audit-log and webhook-log retention may be plan-specific and shorter than the organization's incident-response window.
## Failure / limits
DLP/connector classification does not substitute for downstream object-level authorization.
## Failure / limits
SaaS feature/plan semantics are PRODUCT_VOLATILE and require as-of dates.
## Practice
Current automation products continue to expose materially different retry, execution-history, audit-log, licensing, and policy surfaces; “has a connector” is not a sufficient enterprise comparison axis.
## Practice
n8n documents replay/retry of failed executions with original or current workflow definitions.
## Practice
Make documents an explicit Retry error handler and plan-dependent audit/webhook retention.
## Practice
Power Automate documentation separates connector/DLP policy, licensing/capacity, and execution rights.
## Practice
The canonical packet's credential, side-effect, idempotency, retry, audit, and change-control axes remain current.
## EA-007 — AI連携・自動化ツール大全
### WHY_THIS_MATTERS_TO_UPDATE
Enterprise AIの実運用では、LLM・agent本体よりも、業務SaaS・基幹系・ファイル・メール・CRM・RPA・Webhook等へ接続する自動化層が実際の権限、credential、side effect、再実行、監査、障害復旧の境界を決める。製品名や「連携数」の一覧だけでは事故条件を説明できないため、Zapier / Make / n8n / Power Automate・Copilot Studio / Google Workspace・Apps Script / UiPath等を共通運用軸で比較できる辞典層が必要。


### SCOPE_ROUTING
interoperability / implementation / organization overlay / governance / security / audit / operability / cost / non-LLM automation component / agent-tool boundary


### CLAIM_OR_RESEARCH_QUESTION
1. AI連携・自動化製品を、ブランドではなく共通の運用面で比較できるか。
2. connector / plugin / app / workflow / webhook / RPA / agent actionはどこまで同じ問題として扱え、どこから分離すべきか。
3. 「接続できる」ことと「安全に本番運用できる」ことの間に必要なcontrol planeは何か。
4. retry / replay / resubmitがside effectを二重実行する危険をどのように扱うべきか。


### EVIDENCE TABLE


#### E007-S01 — Microsoft Power Platform data policy
- SOURCE_CLASS: official product documentation
- TITLE: Implement a data policy strategy / Configure data policies for agents
- AUTHOR/ORG: Microsoft
- URL: https://learn.microsoft.com/en-us/power-platform/guidance/adoption/dlp-strategy ; https://learn.microsoft.com/en-us/microsoft-copilot-studio/admin-data-loss-prevention
- ACCESSED: 2026-09-11
- VERSION/STATE: current web docs; Copilot Studio tenant-wide enforcement current as of 2026
- LOCATOR: Business / Non-business / Blocked connector groups; real-time enforcement; connectors in different data groups cannot share data
- LABEL: VERIFIED_SPEC + PRODUCT_VOLATILE
- RELATION: support / limit
- ESTABLISHES: connector利用可否とデータ越境は組織policyで制御可能であり、agent/flowの存在だけでは実行可能性が決まらない。
- DOES_NOT_ESTABLISH: 特定tenantのpolicy実設定、個別connectorの許可状態。


#### E007-S02 — Power Automate limits and run operations
- SOURCE_CLASS: official product documentation
- TITLE: Limits for automated, scheduled, and instant flows / Cancel or resubmit flow runs in bulk
- AUTHOR/ORG: Microsoft
- URL: https://learn.microsoft.com/en-us/power-automate/limits-and-config ; https://learn.microsoft.com/en-us/power-automate/how-tos-bulk-resubmit
- ACCESSED: 2026-09-11
- VERSION/STATE: current 2026 docs
- LOCATOR: throughput limits; persistent 14-day over-limit may turn flow off; resubmit subject to connector/API-call limits; run history is 28 days in the bulk-run UI description
- LABEL: VERIFIED_SPEC + PRODUCT_VOLATILE
- RELATION: support / failure-envelope
- ESTABLISHES: automation capacity is bounded by platform and connector throttling; operational recovery includes cancel/resubmit but resubmit is not equivalent to transaction rollback.
- DOES_NOT_ESTABLISH: every connector’s retry/idempotency semantics.


#### E007-S03 — n8n security audit and executions
- SOURCE_CLASS: author-maintained product documentation / OSS practice
- TITLE: Security audit / All executions / Source control and environments
- AUTHOR/ORG: n8n
- URL: https://docs.n8n.io/hosting/securing/security-audit/ ; https://docs.n8n.io/workflows/executions/all-executions/ ; https://docs.n8n.io/source-control-environments/create-environments/
- ACCESSED: 2026-09-11
- VERSION/STATE: n8n current docs; source control available Business/Enterprise; external storage doc references v2.6.4+
- LOCATOR: audit detects risky nodes, community/custom nodes, unprotected webhooks and credential/database risks; failed executions can be retried with current or original workflow; Git-backed multi-instance environments
- LABEL: VERIFIED_SPEC + OSS_PRACTICE + PRODUCT_VOLATILE
- RELATION: support / counter
- ESTABLISHES: self-hostable workflow engines shift part of security/upgrade/storage responsibility to operator; execution replay and environment promotion are first-class concerns.
- DOES_NOT_ESTABLISH: self-hosting is inherently safer; security audit is a full compliance audit.


#### E007-S04 — Make audit / credentials / SSO
- SOURCE_CLASS: official product documentation
- TITLE: Audit logs / Credential requests / Okta SAML
- AUTHOR/ORG: Make
- URL: https://help.make.com/audit-logs ; https://help.make.com/credential-requests ; https://help.make.com/okta-saml
- ACCESSED: 2026-09-11
- VERSION/STATE: current docs; audit logs Enterprise; credential requests restricted to eligible Partner/Enterprise users; SAML Enterprise
- LOCATOR: audit events cover scenarios, connections, webhooks, keys and credential usage; 12-month audit retention; credential provider can revoke or reauthorize without exposing authentication material to requester
- LABEL: VERIFIED_SPEC + PRODUCT_VOLATILE
- RELATION: support / availability-gate
- ESTABLISHES: credential custody can be separated from workflow authorship; audit/SSO/governance are plan-gated operational features.
- DOES_NOT_ESTABLISH: every connector implements least privilege or fine-grained scopes.


#### E007-S05 — Zapier enterprise governance
- SOURCE_CLASS: official product documentation
- TITLE: Set up single sign-on with SAML / Allowed domains for app connections / Security and Compliance / Enterprise security
- AUTHOR/ORG: Zapier
- URL: https://help.zapier.com/hc/en-us/articles/8496279747085-Set-up-single-sign-on-with-SAML ; https://help.zapier.com/hc/en-us/articles/43996004782349-Allowed-domains-for-app-connections ; https://zapier.com/security-compliance
- ACCESSED: 2026-09-11
- VERSION/STATE: SAML article updated 2026-08-05; allowed-domains article current 2026; product controls are plan dependent
- LOCATOR: SAML/JIT; allowed OAuth account domains; audit/connection tracking; enterprise observability and permissions
- LABEL: VERIFIED_SPEC + PRODUCT_VOLATILE
- RELATION: support / availability-gate
- ESTABLISHES: no-code automationでもidentity、connection origin、audit、permissionのcontrol planeが必要。
- DOES_NOT_ESTABLISH: SaaS platformがdownstream SaaSのauthorization designを代替すること。


#### E007-S06 — Google Workspace Add-ons / Apps Script
- SOURCE_CLASS: official platform documentation
- TITLE: Build Google Workspace add-ons / Apps Script troubleshooting
- AUTHOR/ORG: Google
- URL: https://developers.google.com/workspace/add-ons/how-tos/building-workspace-addons ; https://developers.google.com/apps-script/guides/support/troubleshooting
- ACCESSED: 2026-09-11
- VERSION/STATE: Add-ons guide updated 2026-07-22; troubleshooting current 2026
- LOCATOR: Add-ons can use Apps Script or HTTP; OAuth scopes should be least-permissive; Apps Script recommended for lightweight/smaller-use cases while other runtimes may suit many users/low latency/full infra control; every Apps Script execution is recorded
- LABEL: VERIFIED_SPEC + PRODUCT_VOLATILE
- RELATION: support / limit
- ESTABLISHES: Workspace integration is not synonymous with Apps Script; runtime choice and ownership/project lifecycle matter.
- DOES_NOT_ESTABLISH: Apps Script is unsuitable for all enterprise use.


#### E007-S07 — UiPath audit and robot logs
- SOURCE_CLASS: official product documentation
- TITLE: Automation Cloud — About logs / Audit Logs API
- AUTHOR/ORG: UiPath
- URL: https://docs.uipath.com/automation-cloud/automation-cloud/latest/admin-guide/about-logs ; https://docs.uipath.com/automation-cloud/automation-cloud/latest/api-guide/audit-logs
- ACCESSED: 2026-09-11
- VERSION/STATE: Automation Cloud latest
- LOCATOR: organization/tenant audit APIs; robot logs; audit retention/export differs by plan and log class
- LABEL: VERIFIED_SPEC + PRODUCT_VOLATILE
- RELATION: support / limit
- ESTABLISHES: RPAにはworkflow controlだけでなくrobot/runtime execution telemetryと管理auditの二層が存在する。
- DOES_NOT_ESTABLISH: UI automationがAPI automationより常に低信頼であること。


#### E007-S08 — OpenAPI 3.2.0
- SOURCE_CLASS: open standard
- TITLE: OpenAPI Specification v3.2.0
- AUTHOR/ORG: OpenAPI Initiative / Linux Foundation
- URL: https://spec.openapis.org/oas/v3.2.0.html
- PUBLISHED: 2025-09-19
- ACCESSED: 2026-09-11
- VERSION: 3.2.0
- LOCATOR: standard language-agnostic HTTP API description; paths, callbacks, security schemes, OAuth flows
- LABEL: VERIFIED_SPEC
- RELATION: support / boundary
- ESTABLISHES: typed HTTP API contract is a reusable integration substrate and can describe callbacks/security requirements.
- DOES_NOT_ESTABLISH: API description alone provides authorization, approval, idempotency, runtime governance or business safety.


#### E007-S09 — ChatGPT Plugins/Apps current terminology
- SOURCE_CLASS: official product documentation
- TITLE: Apps in ChatGPT
- AUTHOR/ORG: OpenAI
- URL: https://help.openai.com/en/articles/11487775-connectors-in-chatgpt
- ACCESSED: 2026-09-11
- VERSION/STATE: current; Plugin directory migration dated 2026-07-09
- LOCATOR: plugins may include skills/apps/app templates; apps connect external data/actions; workspace admins govern plugin installation and underlying app access/permissions; custom apps can use MCP
- LABEL: VERIFIED_SPEC + PRODUCT_VOLATILE
- RELATION: support / terminology-boundary
- ESTABLISHES: 「Plugin」と「app/connector/action」を同義語として固定してはならず、distribution/workflow packagingとactual external connection/permissionを分離する必要がある。
- DOES_NOT_ESTABLISH: every plugin has external actions or equivalent permission model.


### FINDINGS
1. **共通比較単位は「製品」よりautomation execution boundary。** 各基盤を少なくとも (a) trigger/event, (b) workflow/orchestration, (c) connector/action, (d) credential/identity, (e) execution runtime, (f) audit/control plane に分解すると、Power Automate・Make・Zapier・n8n・GAS・RPAを同じ表で比較できる。
2. **connector countは弱い指標。** 本番適格性を左右するのは、connectorごとのauth method/scope、credential owner、shared credential可否、connection domain、DLP classification、rate limit、side-effect semantics、auditability、version/change policy。
3. **「credentialを持てる」と「workflow作者がcredential secretを読める」は別。** Make credential requestsのように、credential providerが認可しworkflow側が利用するが秘密値を閲覧しない構成が成立する。一方n8n workflow sharingでは、workflow editorがworkflow内で使われるcredentialsを利用できる旨が文書化されており、共有境界は製品ごとに異なる。
4. **retry/replayは復旧機能であると同時にside-effect risk。** Power Automateのresubmit、n8nのretry-original/current等は再実行を可能にするが、外部API側のidempotency key、dedupe、transaction semanticsが無ければ二重送信・二重作成・二重決済等を防ぐ保証にはならない。
5. **DLPはconnector governanceであり、downstream permissionの代替ではない。** MicrosoftのBusiness/Non-business/Blocked分類はデータ経路を制御できるが、接続先でcredentialが過剰権限ならその権限自体を縮小しない。
6. **Webhook/API/RPAを一括りにしない。** API/OpenAPIはstructured contract、Webhookはevent delivery、RPAはUI/runtime操作であり、observability・retry・schema drift・auth・failure detectionが異なる。共通章では接続方式を別軸として保持する。
7. **LLM/agent integrationは既存automation controlを消さない。** Copilot Studioのdata policyやChatGPT app/plugin管理の例から、agentがworkflow/actionを呼ぶ場合でもworkspace/admin/connector permissionが別control planeとして残る。
8. **SaaS vs self-hostedも単純な安全順位にしない。** SaaSはSSO/audit/governanceをplan-gated featureとして提供し得る。self-hosted n8n等はnetwork/storage/upgrade/node riskを組織側がより直接負う。どちらも責任境界の比較が必要。


### LIMITS / COUNTEREVIDENCE / FAILURE ENVELOPE
- vendor docsは機能存在を示すが、特定tenantの設定・実効権限・運用成熟度は示さない。
- 「監査ログあり」は、必要イベントが全て記録される・十分長く保持される・改ざん耐性がある、を自動的には意味しない。plan、event class、retention、export pathを別確認する。
- workflow retryはtransaction rollbackではない。downstream actionのidempotencyを独立検証する。
- DLP/connector blockはcredential scopeや対象SaaS内部ACLを置換しない。
- OAuth接続はleast privilegeを保証しない。実際のrequested scopeとresource ownerを確認する。
- Webhookはdelivery成功とbusiness processing成功を分ける必要があり、duplicate/out-of-order/replay/schema changeを想定する。
- UI/RPAは画面変更・selector drift・session state・desktop/runtime availabilityのfailureを持ち、API integrationとはfailure envelopeが異なる。
- self-hostingはdata/control localityを増やし得る一方、patching、secret management、network exposure、backup、queue/database運用を組織責任へ移す。


### AVAILABILITY_GATES
- plan/tier: SSO、SCIM、audit retention、source control、credential governance、log streaming等がEnterprise/Business等に限定される例が多い。
- tenant/admin policy: Power Platform DLP、ChatGPT app/plugin enablement、OAuth/domain restrictions。
- connector/app support: connectorごとのregion、authentication method、scope、API limit。
- hosting mode: SaaS / self-hosted / desktop robot / cloud robot。
- identity: human OAuth、service account/service principal、shared connection、credential delegation。
- runtime: network egress、private endpoint/VPC、desktop session、queue worker、execution time/throughput quota。


### IMPLEMENTATION_STATE
- Power Automate / Copilot Studio / Zapier / Make / n8n / Apps Script / UiPathはいずれもproduction-grade maintained implementations。ただし同一カテゴリではなく、iPaaS/no-code workflow、low-code platform、script runtime、RPA/orchestration等が重なる市場である。
- OpenAPI 3.2.0はinterface description standardでありautomation runtimeではない。
- ChatGPT Plugins/AppsはAI client側のdistribution/action surfaceであり、Power Automate等のgeneral-purpose automation runtimeと同一層ではない。


### BENCHMARK_OR_EVAL
この領域に単一の「最強automation tool」benchmarkを置かない。導入評価は最低でも次の実測profileに分ける。
1. SUCCESS RATE: 同一fixtureでN回実行し成功/partial/failureを区別。
2. SIDE-EFFECT SAFETY: timeout後retryでduplicate actionが出ないか。
3. RECOVERY: failed runのresume/retry/replayとmanual compensation所要。
4. THROUGHPUT/LATENCY: connector throttling込みのp50/p95、queue delay。
5. CHANGE RESILIENCE: schema/API/UI change時の破損範囲。
6. GOVERNANCE COVERAGE: identity, RBAC, DLP, secret custody, audit export, environment promotion。
7. COST: task/action/execution/robot/runtime/egress等、課金単位を製品間で正規化して比較。


### SECURITY / PRIVACY / AUDIT / COST / OPERABILITY
- SECURITY: connection credentialとworkflow edit permissionを分離し、service identityを人間credentialで代用しない。custom/community connector/nodeはsupply-chain対象とする。
- PRIVACY: dataがどのconnector/runtime/logへ複製されるかをdata-flow diagramで管理。execution payloadのlog retentionも確認。
- AUDIT: authoring change log、credential/connection change、execution log、admin auditを別event classとして確認する。
- COST: 「1 automation」の課金単位は比較不能。task/action/API call/execution/minute/robot/AI token等に分解する。
- OPERABILITY: owner、environment、version、rollback、retry policy、dead-letter/failed-run queue、alert、runbookを本番受入条件とする。


### SAFE_WORDING_FOR_FUTURE_BOOK
「AI連携・自動化基盤は、コネクタ数ではなく、誰の資格情報で・どの権限を使い・どの実行環境から・何を変更し・失敗時にどう再実行され・その履歴を誰が監査できるかで評価する。Plugin、connector、Webhook、workflow、RPA、agent actionは接続面が重なる一方、同じ安全境界ではない。特に再実行は復旧手段であると同時に二重side effectの入口であり、外部操作のidempotencyと補償手順を独立して設計する必要がある。」


### UPDATE_WORK_HANDOFF
1. 公開後本編では「ブランド一覧」より先に共通比較matrixを作る。推奨列: integration type / trigger / action / auth / credential owner / least-privilege support / DLP / human approval / retry / idempotency support / run history / audit retention/export / env promotion / self-host / private network / rate limits / cost meter / AI-agent surface。
2. Zapier, Make, n8n, Power Automate/Copilot Studio, GAS/Workspace add-ons, UiPathを代表実装として同matrixへ入れる。必要ならWorkato/Pipedream/IFTTT等を追加するが、製品数を成果指標にしない。
3. EA-160（connector/OpenAPI comparison）ではE007-S08を再利用し、OpenAPI contract、generic HTTP action、native connector、MCP tool、RPAの境界を詳細化する。
4. EA-063/159（MCP gateway）とは、connector inventory・approval・credential mediation・auditを接続する。
5. TEST_PROFILE-AUTO-001（未実施）: sandbox対象APIでcreate actionを故意にtimeout/retryし、idempotency key有/無でduplicate side effectを比較。
6. TEST_PROFILE-AUTO-002（未実施）: OAuth scope、workflow editor、credential owner、runtime identityの4者を分離した最小構成を各主要platformで照合。
7. PRODUCT_VOLATILE再確認: plan/tier、audit retention、SSO/SCIM、DLP、AI/plugin terminology、connector availability、rate limitsは出版直前に再確認。


### OPEN_UNKNOWN / STOP_CONDITION

## OPEN_UNKNOWN
- Zapier/Make/n8n/Power Automate/UiPath間で、同一fixtureを使ったvendor-neutralなside-effect/retry比較は未実施。
- 各製品の全connectorについてidempotency保証を一括確認することは不可能であり、重要action単位で確認が必要。
- ChatGPT Plugin directory移行後の各pluginのaction approval・audit granularityはplugin/app固有で、共通保証として閉じない。
- SaaS各社のprivate networking/data residency/log retentionはplan・regionで変動するため個別matrix作成時に再確認。

## STOP_CONDITION
- EA-007の更新着手に必要な共通分類、代表実装、主要governance axis、failure envelope、評価profileが揃ったためbounded close。製品別全機能カタログ化は後続Workへ送る。

## RUN DISPOSITION
EA-007: BOUNDED_CLOSE

## Currentness findings
- Current automation products continue to expose materially different retry, execution-history, audit-log, licensing, and policy surfaces; “has a connector” is not a sufficient enterprise comparison axis.
- n8n documents replay/retry of failed executions with original or current workflow definitions.
- Make documents an explicit Retry error handler and plan-dependent audit/webhook retention.
- Power Automate documentation separates connector/DLP policy, licensing/capacity, and execution rights.
- The canonical packet's credential, side-effect, idempotency, retry, audit, and change-control axes remain current.

## Current primary evidence
- https://docs.n8n.io/workflows/executions/all-executions/
- https://help.make.com/retry-error-handler
- https://help.make.com/audit-logs
- https://help.make.com/webhooks
- https://learn.microsoft.com/power-automate/prevent-data-loss
- https://learn.microsoft.com/en-us/power-platform/admin/power-automate-licensing/types
- https://learn.microsoft.com/en-us/power-platform/admin/governance-considerations

## Counterevidence / failure envelope retained
- Connector count does not prove authorization quality, delivery guarantees, idempotency, rollback, or audit completeness.
- Retry can duplicate non-idempotent side effects when the downstream system lacks a stable idempotency contract.
- Audit-log and webhook-log retention may be plan-specific and shorter than the organization's incident-response window.
- DLP/connector classification does not substitute for downstream object-level authorization.
- SaaS feature/plan semantics are PRODUCT_VOLATILE and require as-of dates.

## SAFE_WORDING
Treat workflow automation as an execution and authority boundary. Record credential owner, trigger, connector/action version, side-effect class, retry/idempotency contract, DLP/policy scope, execution evidence, audit retention, and rollback path rather than comparing products by connector count alone.

## OPEN_UNKNOWN
- exact current retry/backoff/idempotency behavior for every connector and product;
- organization-specific plan entitlements and audit-retention overrides;
- cross-product semantics for replay after workflow edits;
- downstream SaaS object-level authorization and irreversible side effects.

## Research Gate decision
`PASS_FOR_BOUNDED_BASE_REVISION`.

## Candidate implementation overlay
- target: `content/staging/EA-007.md`
- base repository commit: `97d3d104ae0b16a95e7dffddc3a8cb327795a796`
- path precondition: `ABSENT`
- candidate: `V21-CANDIDATE-EA007-BASE-20261011-C1`
- READY: NOT_CREATED
- AUDIT_PASS: NOT_CLAIMED
- GIT_WRITE: NOT_PERFORMED

NEXT: /agent/start.json
STOP: This is a knowledge projection, not an execution order.