Who can actIdentity + roles
Scoped
Security
Security follows the work. Control stays with the customer.
CXFabric connects identity, roles, credentials, runtime boundaries, workflow execution, and operational evidence so security remains part of the process from design through production.
Role boundaries
Protected credentials
Customer-owned runtime
Execution history
Deployment boundaryCustomer environment
Cloud, VPC, or on-prem
What can be reachedCredentials + connectors
Controlled
Where work executesCXFabric runtime
Owned
What can be explainedLogs + work trace
Visible
Policy attached
Environment separated
Changes traceable
The request contract
Authority travels with the work.
Every consequential request should answer four questions before a system changes: who or what initiated it, why it is allowed, which resources it may reach, and what evidence the outcome must leave behind.
Bound requestRefund exception ยท Case 2841
VerifiedIdentityCustomer service event
PurposeResolve billing exception
AuthoritySupervisor approval required
EvidenceDecision and actions retained
Lifecycle controls
Security does not stop when the workflow ships.
Boundaries and evidence stay connected as a workflow moves from design into production and investigation.
- 01
Build
Use approved resources and credentials.
- 02
Test
Validate behavior and error paths.
- 03
Promote
Control versions and environments.
- 04
Operate
Observe runs, failures, and changes.
- 05
Investigate
Recover the evidence behind an outcome.
Execution evidence
See the decision. See what it changed.
Logs become more useful when they retain business context. CXFabric connects the initiating request, applied policy, human decision, workflow version, system actions, and final result in one operational record.
OutcomeRefund approved and completed
- 10:42:18.041Request acceptedcustomer-service
- 10:42:18.083Policy evaluatedapproval-required
- 10:43:02.610Human authority recordedsupervisor
- 10:43:03.174Billing and CRM updatedsuccess
Security review
Start with the work. Then draw the boundary.
A useful security review should produce clear answers about authority, system reach, runtime ownership, and retained evidence for the specific implementation, not a generic checklist detached from the process.
Who can initiate or approve the work?
People, services, events, and AI workers need explicit roles and authority.
Which systems and credentials are in scope?
Reach should be limited to the resources required for the workflow.
Where should the runtime live?
The execution boundary should reflect data, network, and operating ownership.
What must remain explainable?
Decisions, changes, errors, approvals, and recovery should leave usable evidence.