Governance

Enterprise-grade controls

Authentication uses Passport JWT with bcrypt password hashing. Internal endpoints require a service token. Webhooks are verified with provider-specific signatures. All traffic is TLS-encrypted.

• Rate limiting on auth routes
• ServiceTokenGuard on /internal/* endpoints
• Webhook HMAC-SHA256 / token / basic-auth verification

1. AuditAppend-only audit events for auth, vault, integrations, triggers, and workspaces.
2. BudgetMonthly token budgets with hard-stop and warning thresholds, enforced pre-execution.
3. Approval gatesPause any workflow at an approval node until someone signs off, or the request expires.
4. SandboxRun tools in Docker containers or Cloud Run sandboxes with limited CPU, memory, and network.
5. Secret rotationOpt-inRotation policies with due dates, verification against the real provider, and a grace window where old and new both work.