Governance

Every action is logged

Audit events capture who did what and when across the platform. Review them in the dashboard or stream them to your own SIEM for compliance workflows.

• Automatic audit logging for sensitive operations
• Webhook delivery log with payload metadata
• Actor, workspace, and timestamp on every event

1. SecurityJWT auth, bcrypt hashing, webhook signature verification, and service-token guards.
2. BudgetMonthly token budgets with hard-stop and warning thresholds, enforced pre-execution.
3. Approval gatesPause any workflow at an approval node until someone signs off, or the request expires.
4. SandboxRun tools in Docker containers or Cloud Run sandboxes with limited CPU, memory, and network.
5. Secret rotationOpt-inRotation policies with due dates, verification against the real provider, and a grace window where old and new both work.