Governance

Enterprise-gradecontrols

JWT auth, bcrypt hashing, webhook signature verification, and service-token guards.

Authentication uses Passport JWT with bcrypt password hashing. Internal endpoints require a service token. Webhooks are verified with provider-specific signatures. All traffic is TLS-encrypted.

Rate limiting on auth routes
ServiceTokenGuard on /internal/* endpoints
Webhook HMAC-SHA256 / token / basic-auth verification

All features Get started

Related in Governance

Audit

Append-only audit events for auth, vault, integrations, triggers, and workspaces.

Budget

Monthly token budgets with hard-stop and warning thresholds, enforced pre-execution.

Approval gates

Pause any workflow at an approval node until someone signs off — or the request expires.

Sandbox

Run tools in Docker containers or Cloud Run sandboxes with limited CPU, memory, and network.

Secret rotation

Rotation policies with due dates, verification against the real provider, and a grace window where old and new both work.