> ## Documentation Index
> Fetch the complete documentation index at: https://docs.clarion.cantina.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Scheduled & on-demand runs

> Agents that go looking rather than waiting: recurring sweeps, one-off runs, and retriggering an issue.

<Note>
  Not every security problem announces itself. A monitor-driven agent waits for an event; a **scheduled** agent goes and looks. Several of Clarion's templates only exist in the second shape.
</Note>

## Three ways a run starts

| Trigger       | What starts it                                                                                 | Example                                                      |
| ------------- | ---------------------------------------------------------------------------------------------- | ------------------------------------------------------------ |
| **Monitor**   | A connected integration sends an event that matches the agent's monitors.                      | GuardDuty raises a finding; the AWS agent triages it.        |
| **Schedule**  | A cron expression fires.                                                                       | The Exposure Agent sweeps every provider at 09:00 UTC daily. |
| **On demand** | A person clicks **Run now**, retriggers an issue, or asks in [chat](/learn/chat/introduction). | Re-running triage on an issue after new evidence arrives.    |

## Scheduled agents

A schedule carries its own **prompt** — the instructions for that run — plus a standard five-field cron expression and an IANA timezone (UTC by default, so a platform schedule doesn't inherit one team's local time). Schedules are enabled or disabled individually, and deactivating the agent is the master off switch for all of them.

Several agent templates ship with a schedule already attached, materialized and pinned to the agent when you create it:

| Agent                        | Cadence          | What the run does                                                                                                                        |
| ---------------------------- | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| **Knowledge Maintainer**     | Hourly           | Drains connected sources into the Brain under the workspace's editorial policy.                                                          |
| **Dangling Subdomain Agent** | Daily, 06:00 UTC | Enumerates every Cloudflare zone, resolves each delegation target, and asks connected providers whether a live resource still serves it. |
| **Exposure Agent**           | Daily, 09:00 UTC | Probes deployments across connected providers for unintended public exposure.                                                            |
| **Claude Code Governance**   | Weekly, Monday   | Batches every undecided MCP server into one decision for a human.                                                                        |
| **Signal Rule Refinement**   | Weekly, Monday   | Reviews signal-rule performance and proposes tuning.                                                                                     |
| **Risk Assessment**          | Weekly, Monday   | Rates new epics for security and privacy risk before implementation.                                                                     |
| **New Vendor Risk Reviewer** | Weekly, Monday   | Reads Vanta's newly discovered vendor queue. Read-only.                                                                                  |
| **SOC 2 Evidence Collector** | Monthly          | Samples vulnerability-management evidence and drafts it into a Vanta document.                                                           |

You can add your own schedules to any agent, or edit the ones a template brought.

### What a scheduled run can do

A scheduled run is a full agent run, not a cut-down cron job:

* It **files issues** from what it finds, with a per-run cap so a bad night cannot flood the queue.
* It can **ask a human for clarification** mid-run and resume when someone answers — an overnight sweep does not have to guess or abort.
* It **writes verdicts back to the Brain**, so tomorrow's run starts with what today's decided and stops re-reporting things a human already parked.
* It **posts a summary** to the workspace's notification destination, including a clean result, so silence is never ambiguous.

### Failure handling

Each schedule stamps its next firing time on every successful claim, and consecutive spawn failures trip a circuit breaker rather than retrying forever. Run history — start, result, and error — is kept per schedule, and a single run's clarifications are reported together.

## Ad-hoc runs

**Run now** fires a schedule immediately, out of band, without touching its cadence. Multiple in-flight runs are safe: each gets its own run record. This is the usual way to test a schedule's prompt before trusting it overnight, and Members can do it even though authoring schedules is Admin-only.

**Retriggering an issue** re-runs triage on an existing issue — after new evidence lands, after a skill was corrected, or when the first pass was thin.

**Chat** is the fully ad-hoc path: the same tools and skills, driven by a person, with no schedule and no monitor involved. See [AI chat](/learn/chat/introduction).

<CardGroup cols={2}>
  <Card title="Our agents" href="/learn/agents/our-agents">
    Which templates are schedule-driven.
  </Card>

  <Card title="Monitors" href="/learn/agents/monitors">
    The event sources behind monitor-driven runs.
  </Card>

  <Card title="The Brain" href="/learn/agents/brain">
    Where a sweep's verdicts are remembered.
  </Card>

  <Card title="AI chat" href="/learn/chat/introduction">
    Drive the same tools yourself.
  </Card>
</CardGroup>