usertasks
All documentationStart free beta
Documentation hub

Feature guide

Security and governance

Control identity, permissions, secrets, retention, evidence, and tenant boundaries across the platform.

On this page

Complete feature description

Understanding security and governance in UserTasks

Governance spans tenant isolation, membership, roles, object permissions, SSO, directory synchronization, API authorization, encrypted secrets, egress controls, audit logs, retention, and runtime evidence. These controls apply during execution, not only when data is displayed.

Role permissions define what a user may view, design, execute, publish, or administer. User-context credentials re-evaluate live membership and role state, so deactivation and permission changes affect subsequent requests instead of waiting for a token to expire.

Audit and lifecycle records document administrative changes and operational events. Integration call logs, workflow runs, agent traces, retention reviews, and object dependencies provide more specialized evidence for their respective surfaces.

When to use this feature

  • Always—governance is part of every tenant and asset lifecycle.
  • Different teams require separate design, execution, and administration privileges.
  • Identity state is managed in an external directory.
  • Regulatory or contractual evidence, retention, or access controls apply.

What you can build

  • Least-privilege designer and operator roles
  • SSO and directory-managed workspaces
  • Scoped partner/API access
  • Retention and legal-review processes
  • Auditable operational applications
  • Controlled AI and integration tool access

Production design notes

  • Separate design, activation, execution, and administrative permissions where duties differ.
  • Review service credentials and OAuth applications regularly.
  • Treat audit and retention configuration as part of the solution design.
  • Test access using representative non-admin roles before launch.

Core concepts

Tenant isolation

Data and credentials are tenant-bound with RLS and server-side ownership checks.

Role-based access

Permissions govern design, execution, administration, APIs, MCP, and object actions.

Identity lifecycle

Invitations, memberships, SSO, directory sync, role changes, and deactivation affect live authorization.

Audit and retention

Audit events, call logs, workflow history, lifecycle events, and retention reviews preserve evidence.

Actions and capabilities

What designers and operators can do in this product area.

Security and governance actions

The main operations available in Security and governance.

Security and governance actions

Create roles

Bundle granular permissions into tenant roles and assign them to users.

Example: Synchronize employees from an identity provider and grant designers a least-privilege role.
Configuration inputs
  • Permission to view and edit the relevant security and governance assets.
  • The target role, permission, identity connection, secret, policy, or audit filter.
  • Any required mappings, recipients, filters, variables, permissions, or lifecycle settings shown by the designer.
How to use it
  1. 1.Open Settings and Governance from the main navigation.
  2. 2.Create or open the relevant asset and choose “Create roles”.
  3. 3.Complete the required fields, map dynamic values, and review access to every referenced asset.
  4. 4.Use preview, test, or validation where available; correct errors before publishing or executing.
  5. 5.Run the action and inspect its status, output, history, or audit record.
Expected results
  • The security or lifecycle control is enforced within the tenant and leaves audit evidence.
  • Failures remain visible with enough context to correct configuration or retry safely.

Security and governance actions

Manage object permissions

Apply view, edit, execute, or other controls to supported assets.

Example: Synchronize employees from an identity provider and grant designers a least-privilege role.
Configuration inputs
  • Permission to view and edit the relevant security and governance assets.
  • The target role, permission, identity connection, secret, policy, or audit filter.
  • Any required mappings, recipients, filters, variables, permissions, or lifecycle settings shown by the designer.
How to use it
  1. 1.Open Settings and Governance from the main navigation.
  2. 2.Create or open the relevant asset and choose “Manage object permissions”.
  3. 3.Complete the required fields, map dynamic values, and review access to every referenced asset.
  4. 4.Use preview, test, or validation where available; correct errors before publishing or executing.
  5. 5.Run the action and inspect its status, output, history, or audit record.
Expected results
  • The security or lifecycle control is enforced within the tenant and leaves audit evidence.
  • Failures remain visible with enough context to correct configuration or retry safely.

Security and governance actions

Configure SSO or directory sync

Connect identity providers and synchronize user state.

Example: Synchronize employees from an identity provider and grant designers a least-privilege role.
Configuration inputs
  • Permission to view and edit the relevant security and governance assets.
  • The target role, permission, identity connection, secret, policy, or audit filter.
  • Any required mappings, recipients, filters, variables, permissions, or lifecycle settings shown by the designer.
How to use it
  1. 1.Open Settings and Governance from the main navigation.
  2. 2.Create or open the relevant asset and choose “Configure SSO or directory sync”.
  3. 3.Complete the required fields, map dynamic values, and review access to every referenced asset.
  4. 4.Use preview, test, or validation where available; correct errors before publishing or executing.
  5. 5.Run the action and inspect its status, output, history, or audit record.
Expected results
  • The security or lifecycle control is enforced within the tenant and leaves audit evidence.
  • Failures remain visible with enough context to correct configuration or retry safely.

Security and governance actions

Rotate and revoke secrets

Rotate OAuth secrets, revoke tokens and keys, and reconnect provider credentials.

Example: Synchronize employees from an identity provider and grant designers a least-privilege role.
Configuration inputs
  • Permission to view and edit the relevant security and governance assets.
  • The target role, permission, identity connection, secret, policy, or audit filter.
  • Any required mappings, recipients, filters, variables, permissions, or lifecycle settings shown by the designer.
How to use it
  1. 1.Open Settings and Governance from the main navigation.
  2. 2.Create or open the relevant asset and choose “Rotate and revoke secrets”.
  3. 3.Complete the required fields, map dynamic values, and review access to every referenced asset.
  4. 4.Use preview, test, or validation where available; correct errors before publishing or executing.
  5. 5.Run the action and inspect its status, output, history, or audit record.
Expected results
  • The security or lifecycle control is enforced within the tenant and leaves audit evidence.
  • Failures remain visible with enough context to correct configuration or retry safely.

Security and governance actions

Create retention policy

Define duration, exact dates, review, hold, archive, and purge rules.

Example: Synchronize employees from an identity provider and grant designers a least-privilege role.
Configuration inputs
  • Permission to view and edit the relevant security and governance assets.
  • The target role, permission, identity connection, secret, policy, or audit filter.
  • Any required mappings, recipients, filters, variables, permissions, or lifecycle settings shown by the designer.
How to use it
  1. 1.Open Settings and Governance from the main navigation.
  2. 2.Create or open the relevant asset and choose “Create retention policy”.
  3. 3.Complete the required fields, map dynamic values, and review access to every referenced asset.
  4. 4.Use preview, test, or validation where available; correct errors before publishing or executing.
  5. 5.Run the action and inspect its status, output, history, or audit record.
Expected results
  • The security or lifecycle control is enforced within the tenant and leaves audit evidence.
  • Failures remain visible with enough context to correct configuration or retry safely.

Security and governance actions

Inspect audit evidence

Review administrative changes, runtime calls, workflow events, and policy actions.

Example: Synchronize employees from an identity provider and grant designers a least-privilege role.
Configuration inputs
  • Permission to view and edit the relevant security and governance assets.
  • The target role, permission, identity connection, secret, policy, or audit filter.
  • Any required mappings, recipients, filters, variables, permissions, or lifecycle settings shown by the designer.
How to use it
  1. 1.Open Settings and Governance from the main navigation.
  2. 2.Create or open the relevant asset and choose “Inspect audit evidence”.
  3. 3.Complete the required fields, map dynamic values, and review access to every referenced asset.
  4. 4.Use preview, test, or validation where available; correct errors before publishing or executing.
  5. 5.Run the action and inspect its status, output, history, or audit record.
Expected results
  • The security or lifecycle control is enforced within the tenant and leaves audit evidence.
  • Failures remain visible with enough context to correct configuration or retry safely.

Potential use cases

Patterns you can adapt to your own operating model.

Joiner-mover-leaver

Keep access aligned with identity lifecycle and remove runtime authorization quickly.

Directory sync
Membership update
Role assignment
Token live-check
Audit event

Regulated document process

Control access and retain evidence through review and disposition.

Object permission
Metadata classification
Retention assignment
Review workflow
Audited action