Skip to content
Governance
Book a demo

Security & Trust

Unconfigured means off.
Not open.

Governance is a separate application that reuses your Siftly sign-in. The tenant boundary comes from the verified session, and every connection supplies nothing and sends nothing until an administrator turns it on.

Talk to us See the platform

Out of the box

What each connection can do before an admin touches it.

Connection
Can supply
Can send
Out of the box
Microsoft Teams
Nothing
Only an approved message
Off until an admin pairs a destination
Gmail
Nothing
Only an approved message
Off until an editor connects a Google mailbox
Framer
Nothing
Only a previewed draft or publish
Off until an admin connects the site
Box
Only an allowlisted folder
Nothing
Off until an admin allowlists a folder

Invariants

Four things that are true by construction.

These are not settings. Each one exists because the alternative was a failure class we were not willing to leave open.

Tenancy

A request cannot select its organisation with a query parameter or a body field. The tenant is derived from the verified session claim, and nowhere else.

Enforced

Isolation

A user cannot read or change another organisation's resources. There is no path that takes an organisation id as input.

Enforced

Roles

A reviewer can change workflow state. A viewer has read-only access. The distinction is enforced server-side, not in the interface.

Enforced

Authority

Agent output cites evidence. It does not become policy by itself, and it cannot set its own severity.

Enforced

Identity

Single sign-on, without a second account.

  1. 01

    One sign-in

    Governance reuses your existing Siftly session. Your team does not manage a second account or a second password policy.

  2. 02

    Verified claim

    The organisation claim on the verified session selects the linked Governance tenant. Nothing else can.

  3. 03

    Scoped requests

    Every API request is scoped to the tenant derived from that claim, before it reaches any data.

  4. 04

    No dev identity in production

    A development identity is only available when the deployment explicitly runs in development mode.

No API operation can use a tenant identifier that is not derived from a verified session.
The application boundary

Bring your security review to the call.

We would rather answer the hard questions early than send you a questionnaire.

Talk to us