How Sernixa works
Sernixa sits at the decision point between an AI system's intent and the code that performs the action. Your application keeps ownership of execution; Sernixa supplies consistent policy, approval, and evidence.
The decision flow
Every governed action follows the same model:
- Describe the intent. The caller sends a stable intent ID, operation class, risk level, data sensitivity, and systems touched.
- Authenticate the caller. Sernixa resolves the organization, credential, identity, and permissions.
- Evaluate controls. Policy, delegation scope, rate and spend limits, data rules, and approval requirements are applied.
- Return an outcome. The action is allowed, held for review, or blocked with a reason.
- Execute or stop. The caller runs the real action only after an allowed outcome.
- Record evidence. The decision and related events become available for operations and investigation.
Who is responsible for what
| Responsibility | Owner |
|---|---|
| Describe the proposed action accurately | Your agent or integration |
| Authenticate, evaluate policy, and coordinate approval | Sernixa |
| Run the function, tool, or MCP call | Your application or host |
| Validate the business result | The destination system and your application |
| Review governance decisions and Sernixa evidence | Your operators and reviewers |
Understand the three outcomes
| Outcome | What your integration should do |
|---|---|
| Allow | Continue once, then validate and record the downstream result. |
| Review | Pause safely while an authorized person evaluates the request. Respect expiry and rejection. |
| Block | Do not execute. Show the reason to the operator and require a deliberate change before retrying. |
Review is not a softer name for block. It is a distinct outcome for actions that need human judgment.
Read evidence correctly
Sernixa shows several kinds of records because they answer different questions:
| Record | Question it answers |
|---|---|
| Registry entry | What does the organization intend to govern? |
| Trust Graph path | Which identity relationship did the organization explicitly author? |
| Approval | Who reviewed this proposed action, and what did they decide? |
| Audit event | What governance activity did Sernixa record? |
| Discovery observation | What candidate did a configured discovery path observe? |
| Accepted sync | Did Sernixa accept this particular local-agent payload? |
| Flight Recorder event | What did the connected evidence path report for this runtime window? |
Use the narrowest statement supported by the record. For example, inventory does not establish connectivity, a Trust Graph path does not prove a credential is usable, and a recent sync is not a continuous online-presence signal.
Organization boundary
An organization owns its members, roles, API keys, policies, registries, approvals, and evidence. Always confirm the active organization before creating credentials, changing policy, or reviewing an incident.
Next step
If you are setting up a new team, continue with Workspace and team. If the workspace already exists, govern your first action.