Skip to main content
  1. WorkOS verifies a user or service-account identity and maps it to a workspace role.
  2. A forge webhook, CLI command, app action, schedule, or API command creates a durable idempotent operation.
  3. The control plane authorizes workspace and repository scope before queueing.
  4. A worker obtains the minimum source revision and credentials required for the operation, runs the governed pipeline in the allowed isolation class, and emits normalized findings and receipts.
  5. The cockpit, CLI, IDE, and approved provider adapters read the same durable records.
Workspace IDs scope every control-plane record. Cross-workspace access is rejected before lookup results are returned. Integration credentials remain secret references; the secret backend resolves them only at delivery time.
Last modified on July 28, 2026