Private at the start
New apps begin private. Choose invited, password-protected, or public sharing where permitted. Organization policies can add approval rules, and governed data stays inside its entitlement boundary.
The rails around every app
A prompt can ask for access. Your policy decides.
Private defaults, security checks, and isolation give every builder a controlled publishing path. Scanning is best effort and identifies potential risks. Permissions and runtime controls enforce the access boundary.
See the findings before you share
Code, configuration, dependency, and secret checks are part of publishing. Review the findings and their status against the exact version you plan to share.
Know what went into the app
Each published version has an SBOM: an inventory of its software packages and versions. Keep the dependency record alongside the release and its security findings.
Keep app code contained
Apps run in isolated environments with controlled network access, execution limits, and separation from other apps and platform privileges.
No builder’s keys passed around
For enterprise governed sources, each viewer uses their own approved authority. Stored keys and tokens remain in platform-managed connections.
An off switch you control
Disable an app, connection, route, or workflow from the platform. Revoke access without waiting for the builder to change the code.
An enterprise example: governed data
One shared app. Every request checked.
Imagine a team dashboard connected to business records. Opening the app and reading those records are separate decisions, both enforced as the request happens.
Check the app’s audience
Confirm that the person opening the dashboard belongs to an approved audience. A forwarded link carries no extra access.
Check the viewer’s data access
Evaluate the source’s current permissions for this person and this action. Each viewer receives only the records they are allowed to see.
Make the authorized request
Broker the connection using scoped authority. Stored credentials stay outside app code, and direct access to governed destinations is controlled.
Keep the decision traceable
Record who acted, which app and connection they used, the policy evaluated, and whether the request was allowed or refused.
For security and platform teams
See the whole picture. Act on the details.
Answer the questions that scattered prototypes leave open, from the first publish to the day an app is retired.
What’s live, and who is responsible?
Inspect an inventory of apps, owners, audiences, routes, connections, versions, and operating states. Find the apps that use a sensitive connection before changing its access.
Who can publish, connect, and share?
Configure roles, sharing rules, and approved connections from one management surface. See the effective setting and the policy it inherits. Delegate administration within your organization’s boundaries.
What happened to the data?
Trace access to the person or workload that initiated it. Review storage and processing locations, retention rules, and audit export requirements against your organization’s needs.
What happens when something changes?
Revoke access, stop a workflow, transfer ownership, or restore a working release. Review the resulting decisions and keep a record of who made the change.