GlobiGuard Action Gate icon

GlobiGuard Action Gate

Route a proposed action by policy; use a governed executor for an actual side effect

Actions2

Authorize Action

AI-generated

Summary

Authorize an action by sending a detailed policy-routing request to GlobiGuard, which evaluates the action's compliance and sensitivity to determine whether it is allowed, modified, blocked, or queued for approval.

Inputs

  • Action Type (required) — A stable verb describing the exact downstream side effect, e.g., email.send or database.write.
  • Destination Type — Type of the logical destination, such as email, database, or webhook.
  • Destination Name (required) — Stable logical name of the destination, not a secret or full payload value.
  • Destination Resource — Optional logical resource, table, channel, or device group affected by the action.
  • Data Classes — Known sensitivity classes in the action payload, e.g., INTERNAL, CONFIDENTIAL, PCI.
  • Purpose — Business purpose used by purpose-limitation policies to justify the action.
  • Workflow Run ID — Stable workflow execution identifier for evidence correlation, defaults to current execution id.
  • Workflow Step ID — Stable step identifier for evidence correlation, defaults to current node name.
  • Correlation ID — Optional end-to-end correlation identifier.
  • Idempotency Key — Recommended for side effects, a stable upstream business key to survive workflow retries.

Output shape

Five separate output branches, each passing through the original input item augmented with a 'globiguard' json property containing authorization metadata. Branches correspond to authorization decisions: allow, modified, blocked, queued, and error.

Payload summary info is automatically extracted and included. Authorization results classify actions using routingDecision ('ALLOW', 'MODIFY', 'BLOCK', 'QUEUE', or 'ERROR') and detailed evidence for audit. Errors result in items sent to the 'error' output. If the operation is 'reauthorize', it instead checks an existing approval queue entry and returns the latest decision.

Examples

Example 1: Workflow author wants to ensure an email sending action complies with organization's policy and data sensitivity.

Specify 'email.send' as Action Type, set Destination Type to 'Email', provide stable Destination Name and optionally a resource, select related Data Classes such as 'INTERNAL' or 'CONFIDENTIAL', and set the Purpose describing the business justification. The node will then request authorization from GlobiGuard before the action proceeds, routing the item according to policy decision.

Links

Discussion