Use cases
What people actually build, at the level of mechanism.
Each use case names the trigger, the systems involved, how the workflow works, where a human decides, and what the outcome is. No stand-ins for a real conversation about your process.
- use cases across three areas
- 12use cases across three areas
- human control point in every case
- Namedhuman control point in every case
- solution page for each
- Linkedsolution page for each
- for a scoping conversation
- No stand-insfor a scoping conversation
Browse by industry
Industry use cases built from real system combinations.
Each runs two or more connected systems in one governed process, with a named decision point and a complete record.
Industry use case: a business process in a specific industry, built from two or more systems.
Integration pattern: the architecture for one system combination. Browse patterns
Industry
Theme
49 use cases
Public sector
Citizen request to case resolution
Microsoft 365 + ServiceNow + Jira
Requests arriving by email become tracked cases, with technical work handed to engineering and updates sent back.
Public sector
Joiner, mover, leaver for public employees
Workday + Okta + Microsoft 365
Workforce changes become policy-checked identity changes, with collaboration set up and removed on time.
Public sector
Procurement exception handling
SAP + ServiceNow + Microsoft 365
Procurement and invoice exceptions reach a named owner, and SAP changes happen only after approval.
Public sector
Cross-agency file intake and validation
Microsoft Azure + SAP + ServiceNow
Files from other agencies are validated before they touch finance records, and problems become tickets.
Defense & national security
Privileged access change with approval
ServiceNow + Okta + Microsoft 365
Privileged access is granted only after named approval, with every change recorded.
Defense & national security
Cloud incident to controlled remediation
Amazon Web Services + ServiceNow + Jira
Cloud events become incidents and engineering tasks, and remediation runs only when approved.
Defense & national security
Configuration change across controlled environments
ServiceNow + GitHub + ArgoCD
Configuration changes deploy only after approval, with checks and deployment events tied to the change record.
Defense & national security
Secure collaboration onboarding
Workday + Okta + Microsoft 365
New staff receive only the identity groups and collaboration spaces their role allows, after approval.
Financial services
Lead to account and ERP handoff
HubSpot + Salesforce + SAP
Marketing leads become clean sales accounts, and approved deals reach ERP without re-keying.
Financial services
Payment reconciliation and exception handling
Stripe + Xero + ServiceNow
Payments reconcile into accounting automatically, and mismatches become tracked exceptions.
Financial services
Invoice approval and procurement
Coupa + SAP + Microsoft 365
Invoices are checked against procurement records and approved before they are created.
Financial services
Identity changes for regulated staff
Workday + Okta + ServiceNow + Microsoft 365
Access changes for regulated roles carry a case record, approval and full evidence.
Healthcare
Appointment administration and service follow-up
Epic + Oracle Health + Microsoft 365
Appointment changes and service requests reach the right administrative staff and calendars.
Healthcare
Healthcare employee onboarding
Workday + Okta + Microsoft 365
New staff get the identity access and collaboration their role needs, after approval.
Healthcare
Patient service request escalation
Epic + ServiceNow + Microsoft 365
Service requests that need operational support become tracked tickets with communication to staff.
Healthcare
Charge and invoice exception workflow
Oracle Health + SAP + ServiceNow
Administrative charge and invoice mismatches are resolved with approval before finance records change.
Critical infrastructure
Infrastructure alert to incident and remediation
Amazon Web Services + ServiceNow + Jira
Alerts become incidents and engineering issues, and infrastructure changes run only when approved.
Critical infrastructure
Identity access change for operations staff
Workday + Okta + ServiceNow
Operations staff access follows their role, with changes approved and recorded.
Critical infrastructure
Deployment governance
GitHub + ArgoCD + ServiceNow
Every deployment links to an approved change, passing checks and a deployment event.
Critical infrastructure
Operational data to analytics
Amazon Web Services + Snowflake + Microsoft 365
Operational files load into Snowflake reliably, and teams are told when data is ready.
Enterprise
Order to cash across CRM, ERP and billing
Salesforce + SAP + Stripe
Won deals become orders and invoices without re-keying, with exceptions reviewed.
Enterprise
Employee lifecycle automation
Workday + Okta + Microsoft 365 + ServiceNow
Joiners, movers and leavers are handled end to end with a case record and approval.
Enterprise
Customer support escalation
Salesforce + Zendesk + Jira + Microsoft 365
Support issues reach engineering with context, and customers and account teams stay informed.
Enterprise
Commerce to ERP and accounting
Shopify + NetSuite + Xero
Storefront orders reach ERP and accounting with inventory checked and exceptions reviewed.
Enterprise
Marketing to sales handoff
HubSpot + Salesforce + Microsoft 365
Qualified leads reach the right salesperson fast, with duplicates caught.
Enterprise
Procure-to-pay exception workflow
SAP + Coupa + Xero + ServiceNow
Invoice, procurement and payment exceptions are resolved with approval across four systems.
Enterprise
Amazon marketplace to ERP fulfilment
Amazon Seller + NetSuite
FBA and FBM fulfilment context reaches NetSuite with items checked and exceptions held for review.
Enterprise
Multi-channel commerce to ERP
Amazon Seller + Shopify + NetSuite
Shopify and Amazon activity is normalized into one NetSuite flow with one exception path.
Enterprise
Marketplace sales to accounting
Amazon Seller + NetSuite + Xero
Marketplace activity is reflected in NetSuite and reconciled in Xero, with differences approved by finance.
Enterprise
Amazon fulfilment exception workflow
Amazon Seller + ServiceNow + Microsoft 365
Fulfilment problems become owned ServiceNow tickets, with the owner told and the resolution recorded.
Enterprise
Unified commerce operations
Shopify + Amazon Seller + Odoo + Xero
Storefront and marketplace activity flows into Odoo and Xero through one governed process.
Enterprise
Customer order exception handling
Shopify + Zendesk + Jira + NetSuite
An order problem moves from support to engineering and ERP with the customer kept informed.
Financial services
Subscription revenue reconciliation
Stripe + NetSuite + Xero
Billing events are compared with NetSuite and Xero, and differences are approved before correction.
Financial services
PayPal payment exception to service case
PayPal + Xero + ServiceNow
PayPal payment and subscription mismatches become approved, recorded corrections.
Financial services
Expense and budget governance
SAP Concur + SAP + Microsoft 365
Budget changes are checked against policy, approved and followed up in SAP with notification.
Enterprise
Customer issue to engineering resolution
Zendesk + Jira + Microsoft 365
Support tickets that need engineering get a linked Jira issue and the status flows back.
Enterprise
High-priority customer escalation
Salesforce + Zendesk + ServiceNow + Microsoft 365
Cases that meet your escalation criteria become owned incidents with approvals and updates.
Enterprise
Marketing to sales handoff with support context
HubSpot + Salesforce + Zendesk
Sales receives leads with open support issues visible, so outreach starts informed.
Enterprise
BambooHR employee onboarding
BambooHR + Okta + Microsoft 365
New employees get approved access and collaboration setup from BambooHR records.
Enterprise
Personio onboarding and attendance workflow
Personio + Okta + Microsoft 365
Personio records drive approved access and attendance follow-up with exceptions recorded.
Enterprise
ADP recruitment to employee access
ADP Workforce Now + Okta + Microsoft 365
Accepted applicants and work assignments in ADP lead to approved access on day one.
Enterprise
ERP data to Snowflake
SAP + Snowflake + Microsoft 365
SAP finance and sales data lands in Snowflake on schedule, with load results reported.
Enterprise
Commerce analytics pipeline
Shopify + Amazon Seller + Snowflake
Storefront and marketplace data becomes one analytics dataset in Snowflake.
Enterprise
CRM and ERP operational analytics
Salesforce + SAP + Snowflake
Pipeline and ERP data are modelled together in Snowflake for operational reporting.
Critical infrastructure
Cloud event to analytics workflow
Amazon Web Services + Snowflake + ServiceNow
Cloud events are enriched, loaded for analysis and escalated when thresholds are crossed.
Enterprise
CRMConnect order to ERP workflow
CRMConnect + SAP
CRMConnect orders and contracts become validated SAP sales orders and invoices.
Enterprise
CRMConnect invoicing to accounting
CRMConnect + Xero
CRMConnect invoices are recorded and reconciled in Xero with exceptions approved.
Enterprise
CRMConnect ticket escalation
CRMConnect + ServiceNow + Microsoft 365
CRMConnect tickets that need IT or operations become owned ServiceNow cases.
Enterprise
CRMConnect warehouse coordination
CRMConnect + Odoo + Microsoft 365
CRMConnect stock and orders stay aligned with Odoo, with shortages raised to owners.
Automation
Cross-system processes that used to require manual coordination.
These workflows chain enterprise integration, rules and code without requiring AI to be useful.
New employee provisioning
- Trigger
- An HR system creates a new hire record.
- Systems
- HR platform, AD/LDAP, SSO, ITSM and the email and collaboration suite, reached through prebuilt connector actions.
- Mechanism
- A workflow creates accounts, assigns groups from role mappings, opens equipment and access tickets, and confirms each step against the source record before moving on.
- Human control point
- IT or HR approves any access above the standard role template before it is granted.
Outcome: A new starter has working accounts and equipment on day one, with a single record of what was granted and by whom.
See the Enterprise Automation solutionVendor invoice reconciliation
- Trigger
- An invoice arrives in the accounts payable inbox or ERP intake.
- Systems
- ERP, procurement system and a database holding purchase order and receipt records.
- Mechanism
- Rules match the invoice to a purchase order and goods receipt; a code node normalises currency and line items; mismatches are flagged rather than silently adjusted.
- Human control point
- Finance reviews and approves any invoice that does not match automatically, with the discrepancy shown alongside the source records.
Outcome: Matched invoices post without manual handling, and every exception carries the evidence needed to resolve it quickly.
See the Enterprise Automation solutionInfrastructure change through a governed catalog
- Trigger
- An engineer submits a request through the Foundry self-service catalog.
- Systems
- Kubernetes, Terraform, cloud provider APIs and the identity provider for access checks.
- Mechanism
- The request is validated against policy, provisioned through Terraform and Kubernetes actions, and tagged to the requesting team and cost centre.
- Human control point
- Requests above the pre-approved policy threshold route to a named approver before provisioning runs.
Outcome: Engineers get infrastructure without a ticket queue, and platform teams keep a record of who requested what and under which policy.
See the Foundry solutionCross-system customer onboarding
- Trigger
- A signed contract is recorded in the CRM.
- Systems
- CRM, ERP, billing system and the identity provider for portal access provisioning.
- Mechanism
- The workflow creates the customer record across systems, sets up billing terms from the contract fields, and provisions portal access.
- Human control point
- A revenue operations reviewer confirms billing terms before the first invoice is generated.
Outcome: Customer setup across four systems happens as one tracked process instead of four separate manual entries.
See the Enterprise Automation solutionAI
Where a self-hosted model adds judgment rules cannot express.
Every case pairs a model with a defined human control point. None of these describe autonomous decision-making.
Contract clause extraction and review
- Trigger
- A contract is uploaded for review before signature.
- Systems
- Document store, contract management system and a self-hosted model with a legal clause knowledge base.
- Mechanism
- A self-hosted model extracts key clauses and flags deviations from standard terms; deterministic rules check for missing mandatory clauses first.
- Human control point
- Legal reviews flagged deviations and either accepts the extraction or corrects it before the contract proceeds.
Outcome: Reviewers spend time on genuine deviations instead of reading every clause of every contract, with corrections captured for future refinement.
See the Governed AI Automation solutionSupport ticket triage and drafting
- Trigger
- A customer support ticket is created.
- Systems
- Ticketing system, knowledge base and a self-hosted model for classification and draft response generation.
- Mechanism
- The model classifies intent and drafts a response from the retrieved knowledge base articles; rules route billing and legal topics to a human queue automatically.
- Human control point
- An agent reviews and edits the draft before it is sent; nothing goes to a customer unreviewed for the flagged categories.
Outcome: Response drafting time drops for common categories while sensitive topics keep full human authorship.
See the Governed AI Automation solutionSovereign knowledge assistant over internal documentation
- Trigger
- An employee asks a question through an internal chat interface.
- Systems
- Internal document repositories, a self-hosted model and a governed knowledge base built from approved sources.
- Mechanism
- Retrieval pulls relevant passages from the approved knowledge base only, and the model answers with citations back to source documents.
- Human control point
- Access to each knowledge base follows the employee's existing permissions, so the assistant cannot surface documents the person could not already read.
Outcome: Employees get answers sourced from current internal material without documents or queries leaving the organisation's environment.
See the Sovereign AI solutionCredit and limit decision support
- Trigger
- A credit limit increase request is submitted.
- Systems
- ERP, CRM and a self-hosted model summarising account correspondence.
- Mechanism
- Deterministic checks apply policy limits first; a model summarises qualitative signals such as repeated disputes for cases that pass the checks.
- Human control point
- A credit officer approves, adjusts or rejects with a recorded reason, using the rule outcome and model summary together.
Outcome: Clear-cut cases clear automatically, and the officer's time concentrates on the cases that need judgment.
See the Human-in-the-Loop solutionSecurity
Detection, validation and protection with a human in the response path.
Security use cases keep a reviewer between a finding and any consequential action, and describe scope honestly, including what Atlas does not do.
Continuous external attack surface validation
- Trigger
- A scheduled discovery run or a change in DNS and certificate records.
- Systems
- Nexus Atlas discovery and validation engine, asset inventory and ticketing system.
- Mechanism
- Atlas enumerates internet-facing assets, validates exposure and produces a reported finding rather than an unsupervised exploitation attempt.
- Human control point
- Security reviews validated findings before any remediation ticket is raised or exposure is treated as confirmed.
Outcome: Security teams see what changed on their external surface between reviews instead of only during periodic point-in-time scans.
See the External Attack Surface Management solutionAI application red-teaming before release
- Trigger
- A new AI-enabled feature or model endpoint is registered for release.
- Systems
- Nexus Cerberus AI endpoint registry, model registry and reporting pipeline.
- Mechanism
- Cerberus runs OWASP LLM Top 10 test cases mapped to MITRE ATLAS against the registered endpoint and produces signed findings with an AI-BOM of the model's dependencies.
- Human control point
- Application and security owners jointly decide whether findings block release, based on the signed report.
Outcome: AI features go live with a documented security review rather than an assumption that a general model is safe by default.
See the AI Application Security solutionSovereign detection and response
- Trigger
- A detection rule fires on ingested log and telemetry data.
- Systems
- Nexus Sentinel SIEM and SOAR, endpoint and network telemetry sources, ticketing and communication tools.
- Mechanism
- Sentinel correlates the alert against related events, opens a case and can run pre-approved containment actions such as isolating a host.
- Human control point
- An analyst confirms or overrides any containment action before it executes, except for actions explicitly pre-approved for automatic execution.
Outcome: Case creation and initial triage happen immediately on detection, and analysts start from an assembled case rather than a raw alert queue.
See the Security Operations solutionAPI and application traffic protection
- Trigger
- Inbound requests reach a protected application or API.
- Systems
- Nexus Shield, the application or API gateway, and Sentinel for correlated logging.
- Mechanism
- Shield inspects requests against configured rules and blocks or flags traffic matching known attack patterns before it reaches the application.
- Human control point
- Security teams tune and approve rule changes; nothing blocks silently without an entry in the Shield and Sentinel logs.
Outcome: Application traffic is filtered inside the organisation's own boundary rather than through a third-party edge service.
See the Application and API Protection solutionIntegration workflows
Multi-system patterns built from connectors, triggers and code.
Each pattern combines pre-built actions, trigger sources, generic interfaces and Rules + Code in one governed run.
Invoice intake and reconciliation with object storage, SAP and SQL
- Trigger
- New invoice file in AWS S3 or Azure Blob Storage
- Systems
- AWS S3 or Azure Blob Storage, SAP, MSSQL or Oracle
- Mechanism
- A file lands in object storage, SAP and a reconciliation database are checked, Rules + Code matches the result and exceptions go to a named reviewer.
- Human control point
- Finance reviewer approves unmatched or out-of-tolerance invoices
Governed employee access changes with ServiceNow, Okta and Microsoft 365
- Trigger
- New or updated ServiceNow request
- Systems
- ServiceNow, Okta, Microsoft 365 / Calendar
- Mechanism
- A ServiceNow request carries the context, an approver authorises the change, the identity step runs and the outcome returns to the ticket.
- Human control point
- Access owner approves before the identity change runs
Salesforce to SAP order handoff without replacing either system
- Trigger
- Salesforce trigger polling new or updated records via SOQL
- Systems
- Salesforce, SAP
- Mechanism
- A Salesforce record detected by SOQL polling is validated, handed to SAP through the connector or an RFC call, and reconciled back.
- Human control point
- Commercial or finance owner reviews records that fail validation
Customer issue escalation across Salesforce, ServiceNow and Jira
- Trigger
- Salesforce or ServiceNow record change
- Systems
- Salesforce, ServiceNow, Jira
- Mechanism
- One governed run carries an escalation from the customer record to service operations and engineering, and keeps the handoff state visible.
- Human control point
- Service owner confirms escalation into engineering
Event-driven cloud operations with AWS, ArgoCD and Kubernetes events
- Trigger
- AWS CloudWatch, SNS or SQS, ArgoCD or Kubernetes event
- Systems
- AWS CloudWatch, SNS, SQS, ArgoCD, Kubernetes
- Mechanism
- CloudWatch, SNS, SQS, ArgoCD and Kubernetes events start a governed runbook, with approval before any change that policy marks as consequential.
- Human control point
- Operator approves production-affecting remediation
Lead handoff from HubSpot to Salesforce with governed enrichment
- Trigger
- Webhook, HTTP poller or schedule
- Systems
- HubSpot, Salesforce
- Mechanism
- A lead moves from marketing to sales with deduplication, enrichment and routing rules applied in one recorded run.
- Human control point
- Sales operations reviews ambiguous matches before a record is created
Payment and subscription events into CRM and ERP
- Trigger
- Stripe trigger source or scheduled subscription check
- Systems
- Stripe, PayPal Subscriptions, Salesforce, SAP
- Mechanism
- A Stripe event or PayPal subscription change is validated and reflected in Salesforce and SAP under one execution record.
- Human control point
- Finance reviews events that would change revenue records outside policy
Security incident enrichment and ticketing from cloud telemetry
- Trigger
- AWS CloudWatch or CloudWatch Events
- Systems
- AWS CloudWatch, ServiceNow or Jira
- Mechanism
- An AWS CloudWatch event is enriched with Rules + Code and becomes a ServiceNow or Jira work item with the evidence attached.
- Human control point
- Security analyst decides on containment beyond ticket creation
Architecture session
Describe your process and we will map it against these patterns.
Most real processes combine two or three of the mechanisms above. A short conversation is enough to sketch the trigger, systems and control points for your specific case.