For CIOs and engineers9 steps15 min

How it works

Nine steps from a door to a record.

Each step names what the platform enforces and what it writes down. The sequence is the same whether the call arrives from a page, the copilot, the API, MCP, a schedule, or an external event. Worked examples use Pyrana Capital, a synthetic portfolio of nine operating companies, three groups, and one holding company.

01
Author the App document.
One YAML document declares the application: surfaces (the pages where people work), targets (the operations the App performs: agents, workflows, direct operations), tool sources (REST, ODBC, MCP, Databricks, Snowflake, Drive, OneDrive), resources (the versioned outputs it publishes), access (profiles, scope entitlements, approval lanes), and knowledge (standing sets and context search). Agent configuration is plain language. Workflows are declarative. Everything the document names already exists in the platform.
View details
App document
one YAML
app: pyrana-capital-monthly surfaces: [monthly-analysis, group-rollup, holdco-summary] targets: agents: [revenue-analyst, materials-analyst, labor-analyst] workflows: [monthly_analysis, intercompany_reconciliation] operations: [reconciliation.adjust] tool_sources: [erp-odbc, snowflake-finance, drive-close-binders] resources: [opco-analysis, group-rollup, holdco-summary, adjusting-entry] access: profiles: [analyst, group-controller, approver] lanes: { intercompany-approvers: { threshold: 100000 USD } } knowledge: standing_sets: [close-policy, intercompany-rules] context_search: true
NoteIllustrative. Pyrana Capital is a synthetic portfolio.
Recorded asApp documenttarget catalogtool bindings

Push, activate, deploy.

Push compiles the document into an immutable version and registers the App identity; it activates nothing. Activate moves the active pointer to a version, is audited, and requires an App owner. Rollback is an activation of a prior version. Deploy ships a frontend image and registers and activates nothing. Three separate states, separately governed.

View details

finance-close · App definition

compile → version → activate

# Illustrative App document (excerpt). Pyrana Capital is a synthetic portfolio.
app_key: finance-close
version: v14                 # compiled, content-digested: sha256:3f9a71c2…e08b
surfaces:
  monthly-analysis: { path: /close/monthly, reads: [close.summary, variance.report] }
targets:
  monthly_analysis: { publishes: [close.summary, variance.report], doors: [page, copilot, api, mcp, schedule] }
  ledger.journal.post: { doors: [page, copilot, mcp], approval: approval.journal.amount }
agents:
  close-reviewer: { model: provider/model, tools: [ledger.accruals.list, ledger.journal.post] }
workflows:
  monthly-close: { schedule: "0 2 * * 1-5", fan_out: { agent: close-reviewer, per: entity } }
tool_sources:
  ledger: { kind: odbc, binding: erp-finance }
resources:
  close.summary: { versioned: true, stale_publish: refuse }
access:
  profiles: { controller: [read, run, approve] }
  entitlements: { controller: [entity:US-01] }
  approval:
    approval.journal.amount: { when: "amount >= 25000 USD", lane: controller-approval }
knowledge:
  standing_sets: [close-policy, entity-calendars]   # cortIQ, preloaded before the first turn
activation: v14              # one pointer; rollback moves it back

Versions

Activation moves one pointer. Rollback moves it back. The version itself never changes.

Recorded asAppConfigVersiondigestactive pointer revision

03
A surface and a target.
A surface is a declared page where a person works. It reads the App's resources at exact versions, and when the person asks the copilot for something, the platform hands the agent the exact page context: which page, which entity, which period, which resource versions. A target is an operation the App performs, declared once and reachable from many doors: the App's own pages, the copilot, the API, MCP from any agent as the user, a schedule, an external event.
View details
surface · monthly-analysis
page context
page
Monthly Analysis · OpCo Northwind Foods · 2026-06
reads
about sixteen resource types at exact versions · opco-analysis@v3 · revenue-bridge@v2 · labor-summary@v1 …
page context
surface=monthly-analysis · entity=opco-04 · period=2026-06 · resource versions pinned
target
monthly_analysis · declared once · publishes about nineteen resource types
Pagesperson via SSO
Copilotagent for a person
APIservice via OAuth
MCPany agent, as the user
Scheduleworkflow principal
Eventexternal system
NoteIllustrative. Pyrana Capital is a synthetic portfolio.
Recorded assurfacepage contexttargetdoor
04Built
The gate: eight steps.
Every call, from every door, passes one gate before anything runs. 1. Identity and idempotency key. 2. Active App version. 3. Target exists and the caller is allowed. 4. Page and resource references resolved to exact versions. 5. One authorization check: membership, profile, entitlement on the entity. 6. Idempotency claimed; execution row and audit record written in one transaction. 7. Dispatch to the native host. 8. Outcome recorded. The gate fails closed. Unauthorized things read as absent, not denied. One desk serves the page, the schedule, the agent, the workflow, and the external system.
View details
the gate
fail closed
admit
caller=maya.chen · version active · target allowed · refs pinned · authorized · idempotency claimed · audit written · dispatched
refuse
caller=j.lee · no entitlement on entity · target absent from results
Recorded asexecution rowaudit record before dispatchidempotency key
05
Pick a lane.
The App routes each target to the lane that fits. Direct for deterministic work with no model. Agent for adaptive work with tools, subagents, suspension, checkpoint, and resume. Workflow for durable, long-running graphs on Temporal. Batch to run one target across many entities. Event for schedules and webhooks with explicit continuation. The gate is common; execution semantics are not forced to be.
View details
lanes
Directdeterministic · no model
Agentadaptive · tools · subagents · resume
Workflowdurable graph on Temporal · fan-out
Batchone target · many entities
Eventschedule · webhook · NEW | JOIN | NONE
Recorded aslanenative run reference
06
Fan out and publish back.
One workflow dispatches specialized agents per entity and per group, in parallel. Each pulls only what its job needs through the tools it was given: the agent passes the entity and the period, the tool holds the query. Each reads what siblings and prior runs published, and everything publishes back to the App as resources. Illustrative: one monthly run over nine operating companies, three groups, and one holding company produces 45 agent executions and 36 published references. Pyrana Capital is a synthetic portfolio.
View details
workflow · monthly_analysis · 2026-06
fan-out
holdco pyrana-capital ×1 groups ×3 each reads its opcos and the 2026-05 roll-up opcos ×9 revenue-analyst · materials-analyst · labor-analyst tools scoped to entity + period · the tool holds the query reads sibling outputs · prior run publish opco-analysis → group-rollup → holdco-summary totals 45 agent executions · 36 published references
NoteIllustrative. Pyrana Capital is a synthetic portfolio.
Recorded aschild executionspublished referencestool calls with receipts
07
Retrieve context with receipts.
Standing sets of Context Units preload before the first turn. Mid-run, the agent calls context search, pauses, retrieves, and resumes; chat uses the same path. On the engine side, a query agent plans the graph walk and repairs its own queries, and a learning agent scores what was retrieved and used. Every unit is accounted for per run: retrieved ⊇ injected ⊇ cited. A citation the model was never given is recorded separately.
View details
cortIQ · run accounting
retrieved
12
injected
6
cited
2
cxu:1220a7ff…f843cxu:9b31e0d4…21aa
standing set intercompany-rules preloaded · 1 mid-run context search · cited_unknown 0
Recorded asretrievedinjectedcitedcited_unknown
08Built
Approve where policy says.
A tool approval policy over typed arguments decides whether a call needs a person. Above threshold, the invocation, its arguments, scope, and evidence freeze into a durable proposal the waiting agent cannot alter. Each named lane receives an obligation; reviewer eligibility is checked at decision time; the frozen call is revalidated before it dispatches once. A queued request is visibly different from a posted entry.
View details
frozen proposal
intercompany lane
tool
reconciliation.adjust · adjusting entry 184,200.00 USD · PMW ↔ MWM
args hash
sha256:9c41…e0b2
policy
{ approval.intercompany.adjustment }@v4 · amount >= 100,000 USD
lane
intercompany-approvers · obligation open
PMW approver
can act · entitlement approve on PMW
MWM approver
cannot act · reads the request · no approve entitlement on PMW
state
queued · nothing posted · revalidate then dispatch once on approval
NoteIllustrative. Pyrana Capital is a synthetic portfolio.
Recorded asfrozen proposalobligations and decisionsrevalidationdispatch once
09
Versioned resources and the record.
Outputs publish as resources: versioned, immutable, attributed. v1 is published by an agent run; v3 is revised by the copilot on behalf of a person; every version names who produced it. Publishing against a stale version is refused, never overwritten. Pages read a resource at an exact version. Every call leaves one execution record: caller, App version, target, resource versions, authorization outcome, approvals, effects with receipts, and the context cited.
View details
execution record
exec_01J9Q4M7Z3 · completed · 6.2s
caller
maya.chen (sso) → finance-close@v14 → agent:close-reviewer → tool:ledger.journal.post
app version
finance-close v14 · sha256:3f9a71c2…e08b
authorization
member · controller · entity:US-01 · period:2026-08
resources
close-narrative v1 (agent run) → v3 (copilot for maya.chen) · publish against v2 refused as stale
policy
{ approval.journal.amount } → approval required
approval
controllers · j.alvarez · 2026-09-02T14:07:11Z
effects
erp.journal.create → JE-88213 · receipt sha256:b71d…
context
retrieved 12 ⊇ injected 6 ⊇ cited 2
Statusversioned resourcespublication, provenance, legal hold
Recorded asresource versionattributionone execution record

+Architecture

Seven layers on identity, authorization, and audit.

The stack is built once and shared by every application: the harness, the orchestration layer, tools and tool sources, tool approval policies, durable storage, the context engine, and the surface layer. Under all of it: identity, authorization, audit. Tenant boundary, fine-grained access, one execution record per call.

layers

one application contract, native semantics preserved

SurfacesApp shell · declared pages · copilot · personal pages
The gateidentity · version · target · refs · authorization · idempotency · dispatch · outcome
Harnessnative tool calling · planning · subagents · checkpoints · resume
Orchestrationdurable workflows · fan-out · wait · retry · finish
Tools and tool sourcesREST · ODBC · MCP · Databricks · Snowflake · Drive · OneDrive · extensions
Tool approval policiesthresholds · frozen invocations · named lanes · revalidation
Storage and contextversioned resources · artifacts · cortIQ Context Units

Identity · authorization · audit: SSO (Entra ID, OAuth) · tenant isolation with row-level security · OpenFGA · per-agent identity · audit record before execution · deployed into a dedicated private tenant, or the client's own infrastructure

Authorization in layers, shared by people and agents

tenant, App membership, access profile, scope entitlement, approval lanes

step 04

Tenant isolation

row-level security in Postgres; unauthorized items absent from results

step 04

Page context handed to the agent

surface, entity, period, resource versions

step 03

Durable execution

Temporal workers, checkpoint and resume, separate worker pools

step 05

Human approval as policy

typed conditions, frozen invocations, named lanes, revalidation

step 08

Idempotent external effects

idempotency key claimed at the gate, effect receipts, reconciliation

step 04

Audit before execution

execution row and audit record in one transaction, before dispatch

step 04

Credentials the agent never sees

platform-held tool credentials, delegated tokens for extensions

step 06

Versioned, roll-backable configuration

immutable versions, one active pointer, activation audited

step 02

Versioned, attributed resources

stale publish refused, pages read exact versions

step 09

Go deeperSecurity and trust6 min

?Questions

Frequently asked

Is the gate a gateway in front of the App or part of it?

Part of it. The gate runs inside the App boundary, against the active version, before the native host is called. A gateway in front cannot resolve the App's profiles, entitlements, or approval policy; the gate can, because the compiled version carries them.

What happens during a migration from an older authorization path?

An installation moves through legacy, shadow, dual, and App-enforced states. Shadow records what the gate would decide; dual requires both paths to allow a call; App-enforced makes the gate authoritative. There is no state in which either path may allow a call on its own.

How do child calls stay inside their parent's authority?

A child call carries the parent's pinned authority and must also pass live authorization. It can be narrower than the parent but never wider, and a policy change made after the parent started can still deny a later child.

What is a personal page?

A person asks the copilot for a page. The copilot inspects the rendering contract and the resources and read capabilities the person may use, authors the page, and the backend compiles it: no network, no imports, no storage, no authority. The compiled page is saved as an immutable, parent-linked revision, and the browser renders it with every read still authorized. Personal pages are read-only today. App-wide publication of a generated page is a later, privileged path.

Which of these steps are live today?

Authoring, push and activate, surfaces and page context, lanes, fan-out, retrieval with accounting, and versioned resources with stale-publish refusal are live. The eight-step gate and tool approval policies are built and enabled per installation and per App. Personal pages are built in read-only mode. In development: the pre-run data quality check, the eval pipeline, user-principal pass-through to data platforms, and publication with provenance and legal hold. The dated capability table is on the platform page.

One process, nine steps, one record.

A demo runs a client process from a door to the execution record, on the client's systems.

Book a demo Security and trust

Nine steps from a door to a record.

Author the App document.

Push, activate, deploy.

A surface and a target.

The gate: eight steps.

Pick a lane.

Fan out and publish back.

Retrieve context with receipts.

Approve where policy says.

Versioned resources and the record.

Seven layers on identity, authorization, and audit.

Frequently asked

One process, nine steps, one record.