Trust
Security controls
Protect credentials, restrict access, and preserve an audit trail.
Access boundaries
Projects isolate workflows, connections, and run data. Assign the narrowest workspace role that lets a teammate do their job, and use service accounts for automated callers.
Secrets
Store credentials as project secrets or managed connections. Secrets are encrypted at rest, injected only during execution, and redacted from logs and run outputs.
API keys
API keys are project-scoped. Give each environment and external system a separate key so it can be rotated or revoked without interrupting unrelated callers.
Audit events
Administrative changes—including membership, key creation, connection changes, and deployment—produce immutable audit events. Export events to your security monitoring system for centralized retention.
Before production
- Review workspace membership and service-account ownership.
- Rotate keys used during development.
- Confirm retention and data-region settings.
- Test provider revocation and incident procedures.