Thanks for sharing the detection. You’re very close—there’s one key misconfiguration that’s likely preventing it from firing. What’s happening - You’re using a Proactive trigger (SLA-style): after it sees

prefect.flow-run.Running

, it waits up to

within

seconds for the events listed in

expect

. If it doesn’t see them, it fires. - Your

expect

is

["prefect.flow-run.*"]

. That’s so broad that any subsequent flow-run event will satisfy the expectation and prevent the SLA from firing. For long-running runs, you generally want to “expect” a state change that indicates the run finished (or at least left Running). Pick the behavior you want and use the matching expect list Option A — “Cancel if not finished within 60 minutes” (common SLA) - Fires if the run does not reach a terminal state within 60 minutes. - Use terminal states in expect:

{
  "type": "event",
  "posture": "Proactive",
  "match": {
    "prefect.resource.id": "prefect.flow-run.*"
  },
  "match_related": {
    "prefect.resource.id": "prefect.tag.hourly",
    "prefect.resource.role": "tag"
  },
  "after": [
    "prefect.flow-run.Running"
  ],
  "expect": [
    "prefect.flow-run.Completed",
    "prefect.flow-run.Failed",
    "prefect.flow-run.Cancelled",
    "prefect.flow-run.Crashed"
  ],
  "threshold": 1,
  "within": 3600,
  "for_each": [
    "prefect.resource.id"
  ]
}

Option B — “Cancel only if still Running after 60 minutes” (strictly “still running”) - Fires only if the run hasn’t left Running within 60 minutes (i.e., any state change prevents firing). - Expect any state change away from Running:

{
  "type": "event",
  "posture": "Proactive",
  "match": {
    "prefect.resource.id": "prefect.flow-run.*"
  },
  "match_related": {
    "prefect.resource.id": "prefect.tag.hourly",
    "prefect.resource.role": "tag"
  },
  "after": [
    "prefect.flow-run.Running"
  ],
  "expect": [
    "prefect.flow-run.Completed",
    "prefect.flow-run.Failed",
    "prefect.flow-run.Cancelled",
    "prefect.flow-run.Crashed",
    "prefect.flow-run.Paused",
    "prefect.flow-run.Cancelling"
  ],
  "threshold": 1,
  "within": 3600,
  "for_each": [
    "prefect.resource.id"
  ]
}

Notes and quick checks - Event names are case-sensitive:

Running

,

Completed

,

Failed

,

Cancelled

,

Crashed

,

Paused

,

Cancelling

. -

match_related

is fine as you wrote it; you can keep the array value or just use a single string: -

"prefect.resource.id": "prefect.tag.hourly"

is also valid. - Ensure your Automation includes an action like: -

{"type": "cancel-flow-run"}

- If you want to verify quickly, temporarily set

within

to something small (e.g., 120) and test a tagged run. - If a run retries and re-enters Running, the window resets at the new Running event. If you can, please share: - The full Automation JSON (including actions and whether it’s enabled) - A specific flow run ID that should have been caught - Your Prefect version (assuming 3.x) Docs for reference: - Automations (Prefect 3) - Events and event matching