Credential values stay outside the system source.
Credentials stored in the Swirls project vault stay out of the system source and are scoped to the work that needs them.
Read about project secretsPut authority in the system model.
The .swirls source shows who can enter an App, which resources it can reach, where credentials enter the run, and which decisions stop for a person. The runtime applies the supported boundary.
Read the boundary in source. Verify it at runtime.
The App declares what it can reach.
The Swirls runtime enforces who can enter an App and which declared resources that App can reach.
Read about accessGive approvers the system boundary in source.
People and roles
External systems
Credential slots
Consequential decisions
Failure and recovery
Acceptance criteria
Swirls applies supported controls. Your team still decides whether the policy, system design, and business behavior are acceptable.
Decide whether the design matches the business and its risk.
Your reviewers own the policy intent, business context, acceptance criteria, and decision to put the system into use.
Apply the supported controls in the approved source.
The runtime enforces supported access rules and supplies stored credentials to declared work. The project source defines those controls.
Put the source in the security review.
Show the people, roles, external systems, credential slots, review gates, and failure policy before the system starts work.