Unclassified
29 · Security & Governance
Identity, tenancy, authorization, approvals, secrets, audit, provenance, isolation, and fail-closed behavior — how the platform stays governable.
Governance Is Operational, Not Decorative
Every stage in Pipeline and Platform Execution is identity-bound, tenant-isolated, and auditable.
| Control | How it works |
|---|---|
| Identity | IW One Auth — Descope + Nango, tenant-scoped, per-identity authority |
| Tenancy | One Spine per tenant; projections, capabilities, and memory isolated by tenant and Work context |
| Authorization | Capability resolution checked against authority before planning leaves the Workbench |
| Approvals | Governed plans require durable approval verdicts before Hermes receives them |
| Secrets | Never in projections; scoped to executors, not to AI context |
| Audit | Every Work, governance verdict, execution, and reconciliation is traced with lineage |
| Provenance | Every Spine fact carries which provider, connector, flow, and verdict produced it |
| Isolation | Operational sandboxes per tenant; no cross-tenant reads or writes without governed action |
| Fail-closed | Unclear authority or missing verdict → deny; unclear verification → do not promote |
Fail-closed is canonical. If you are unsure whether a stage may proceed, it may not.
Where to Go Next
<CardGroup cols={2}>The policy → plan → approval → authorization flow.
Who is acting, and under what authority.
How governance and execution are observed in production.