> ## Documentation Index
> Fetch the complete documentation index at: https://veridical-dev.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Data flow and tenancy

> How identity, source, evidence, and integrations move

1. WorkOS verifies a user or service-account identity and maps it to a
   workspace role.
2. A forge webhook, CLI command, app action, schedule, or API command creates a
   durable idempotent operation.
3. The control plane authorizes workspace and repository scope before queueing.
4. A worker obtains the minimum source revision and credentials required for
   the operation, runs the governed pipeline in the allowed isolation class,
   and emits normalized findings and receipts.
5. The cockpit, CLI, IDE, and approved provider adapters read the same durable
   records.

Workspace IDs scope every control-plane record. Cross-workspace access is
rejected before lookup results are returned. Integration credentials remain
secret references; the secret backend resolves them only at delivery time.