Concept
One approved origin, action, and justification at a time.
A workflow is the unit of authorization and execution: an exact origin plus an exact action with non-secret input, credential references, an evidence policy, and a justification, admitted under an idempotency key.
Definition#
A workflow is a submitted request to run one reviewed journey on one origin. Possessing credentials does not authorize a new origin or action: organization, origin, action, credential references, justification, idempotency, and evidence policy must all be admitted through the safe Weles client before the host runs anything.
| Field | Requirement |
|---|---|
origin | Exact HTTPS origin from the caller's allowlist; normalized before sending. |
action | Exact action identifier from the allowlist, for example export-approved-report. |
input | Non-secret JSON payload; key names matching password, secret, token, cookie, authorization, or proxy-auth patterns are rejected (the sole exception is the resumeToken continuation handle, which is still redacted from errors). |
credentialRefs | Opaque identifiers resolved by the executor's secret boundary — never credentials themselves. |
evidencePolicy | The evidence contract for the run, for example receipt or action-log. |
justification | Required human-readable reason, carried with the request. |
idempotencyKey | Caller-controlled or generated UUID; persist your own when reconciliation across restarts matters. |
Acceptance is not completion#
An accepted submission enters the scheduler's action log and resolves later to a terminal state. Acceptance depends on executor policy, target state, human approval where required, and the reviewed trajectory — not merely on the caller's allowlist.