{"slug":"implementation/security-governance","title":"29 · Security & Governance","section":"implementation","sectionLabel":"Implementation","status":"unclassified","type":"document","path":"implementation/security-governance.mdx","bytes":2049,"description":"Identity, tenancy, authorization, approvals, secrets, audit, provenance, isolation, and fail-closed behavior — how the platform stays governable.","updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n## Governance Is Operational, Not Decorative\n\nEvery stage in [Pipeline](/work/pipeline-view) and [Platform Execution](/platform/platform-execution-view) is **identity-bound, tenant-isolated, and auditable**.\n\n| Control | How it works |\n|---|---|\n| **Identity** | IW One Auth — Descope + Nango, tenant-scoped, per-identity authority |\n| **Tenancy** | One Spine per tenant; projections, capabilities, and memory isolated by tenant and Work context |\n| **Authorization** | Capability resolution checked against authority before planning leaves the Workbench |\n| **Approvals** | Governed plans require durable approval verdicts before Hermes receives them |\n| **Secrets** | Never in projections; scoped to executors, not to AI context |\n| **Audit** | Every Work, governance verdict, execution, and reconciliation is traced with lineage |\n| **Provenance** | Every Spine fact carries which provider, connector, flow, and verdict produced it |\n| **Isolation** | Operational sandboxes per tenant; no cross-tenant reads or writes without governed action |\n| **Fail-closed** | Unclear authority or missing verdict → deny; unclear verification → do not promote |\n\n\nFail-closed is canonical. If you are unsure whether a stage may proceed, **it may not**.\n\n\n## Where to Go Next\n\n<CardGroup cols={2}>\n  \n    The policy → plan → approval → authorization flow.\n  \n  \n    Who is acting, and under what authority.\n  \n  \n    How governance and execution are observed in production.\n  \n</CardGroup>\n"}