Security architecture
Identity, access and execution designed around your existing controls.
Nexus integrates with the identity, network and secrets management the organization already runs rather than introducing a parallel set of controls to manage separately.
- through your identity provider
- SSO + MFAthrough your identity provider
- directory integration
- AD/LDAPdirectory integration
- secrets, not stored in workflows
- Vault-backedsecrets, not stored in workflows
- control plane and execution plane
- Separatedcontrol plane and execution plane
Identity and access
Access follows the identity system you already operate.
Nexus does not ask an organization to run a second identity system alongside the one it already trusts.
- Single sign-on
- Authentication integrates with the organization's existing identity provider, so access follows the same lifecycle as every other application.
- Multi-factor authentication
- MFA is enforced at sign-in through the identity provider, without a separate credential store for Nexus to manage.
- Directory integration
- Active Directory and LDAP integration lets group membership drive role assignment instead of managing users twice.
- Role-based access control
- Permissions are assigned to roles, not individuals, covering workflow authoring, approval, publishing and administration separately.
- Separation of duties
- The person who authors or edits a workflow can be restricted from approving its own production changes, and the person who approves a case can be restricted from also configuring the rules it runs against.
Control plane vs execution plane
Configuration and execution are architecturally separate.
This separation is what allows administration to be centralized while operational data stays inside the environment it belongs to.
The control plane configures. It does not process your data.
Workflow design, connector configuration, role assignment and deployment settings live in the control plane. This is where an administrator defines what should happen.
The execution plane runs inside your environment.
Workflow execution, connector calls, database queries and model inference happen in the execution plane, deployed inside the infrastructure you operate. Operational data is processed there, not shipped elsewhere to be evaluated against the configuration.
The separation keeps operational data close to where it is used.
Because the execution plane runs alongside the systems it integrates with, data in transit is limited to the connections a workflow already needs, rather than passing through an intermediate service to be orchestrated.
Secrets and credentials
Credentials live in a vault, not inside a workflow definition.
A workflow that authenticates to a downstream database or API references a secret by name. It never stores the secret's value.
Vault-managed storage
Secrets used by connectors and code steps are stored in a vault, retrieved at execution time and never written into workflow definitions or logs.
Scoped access to secrets
Role-based access controls which workflows and which people can reference a given secret.
Rotation without workflow edits
Rotating a credential in the vault updates every workflow that references it, without requiring each workflow to be edited individually.
Network posture
Deployment respects the network boundaries you already enforce.
- Network segmentation
- Deployment respects the network zones already defined by the organization, including separation between corporate, DMZ and restricted segments.
- Outbound connectivity
- Outbound connectivity is not required for the platform to operate. Deployments can run fully disconnected, see air-gapped deployment for detail.
- Encryption in transit
- Connections between platform components and to downstream systems use standard transport encryption consistent with the organization's own certificate infrastructure.
- Kubernetes-agnostic deployment
- The platform deploys onto the organization's own Kubernetes distribution, so network policy already applied at the cluster level continues to apply.
Audit and observability
Every execution produces a record, not just an application log.
What gets recorded
Each workflow execution retains its trigger, the connector and code steps it ran, any AI output produced, the reviewer identity for any approval step, and the final system action taken. This record is retained inside the deployment and is available for the organization's own audit and observability tooling.
Observability integrates with the metrics and logging stack the organization already runs, rather than requiring a separate monitoring product exclusively for Nexus.
Relevant capabilities
Where this architecture is implemented.
Governance and Audit
Identity, RBAC, secrets and the execution record in detail.
ExploreDeployment
On-premises, private cloud, sovereign cloud and air-gapped options.
ExploreSovereign AI
Self-hosted models operating inside the execution plane.
ExploreEnterprise Integration
How connectors authenticate to downstream systems.
ExploreArchitecture session
Bring us your identity and network setup.
We will walk through how SSO, RBAC, secrets and network segmentation map onto what you already operate.