Put access rules in the same source as the work.

Say who can open the editorial desk, what they can reach once inside, and who is allowed to approve a draft that is sitting and waiting.

Join private betaSee how it works

Authority should be visible where the action is defined.

Model the roles you actually have. Give each one the records, actions, and decisions it needs. Then read the rule in the same place as the screen or process it protects.

The runtime applies the declared boundary.

A role matches something true about a person, like their department. A rule gives that role an assistant and the processes it may run. The desk decides who can sign in, and approvals happen on one page.

Example: Editors matching the editorial department reach the assistant and the one process it runs, the desk admits them by invitation through your company sign-in, and approvals happen on one page.

Swirls owns the production work behind it.

Supported identity checks, and holding the access your file describes while the work runs.

Get in

Decide who can open the desk at all.

Reach

Limit the records and actions available once they are in.

Approve

Put the decisions that matter in front of someone allowed to make them.

editorial/desk
editorial-desk.swirls
role editorial {
  description: "Editorial staff"
  match {
    department: "editorial"
  }
}

policy {
  allow editorial -> agent editor_assistant {
    workflows: [publish_article]
  }
}

app editorial_desk {
  audience {
    admission: invite
    auth: oidc
    idp: editorial_clerk
  }

  page approvals {
    label: "Awaiting review"
    reviews: [publish_article]
  }
}

Role

editorial · department: editorial

Policy

Allow editorial to use editor_assistant with publish_article as its only tool.

App audience

Invite only, through your company sign-in. Approvals happen on one page, and nowhere else.

Covers

  1. Who the app is for
  2. Roles and responsibilities
  3. What each role can reach
  4. Human review
  5. Administrative access
Read the technical docs

You own

The roles, what each rule is meant to do, where the limits sit, and the judgment that the design is right for the business.

Name the people and the authority they need.

Decide what each group may open, see, start, approve, and change before anyone uses it.

Join private betaSee how it works