The control layer
your processes run on.
Every process flow8 runs answers to a rule. Who can build it, who must approve it before it acts, what it's allowed to touch, and a permanent record of every decision. Control isn't a policy document — it's enforced in the engine.
Governance is how the engine behaves — not a checkbox.
Other tools let anyone build anything and run it unattended. flow8 puts controls where the work actually happens: at the step, before it executes.
Nothing consequential runs without sign-off.
Drop an approval gate into any process and it pauses at exactly that step. The request routes to the person responsible, and the run waits — no timeout pressure, no silent auto-approval. They approve or reject, and the decision is recorded with their name and the time. The process resumes only on a yes.
- ✓ Pause any step until a named person decides
- ✓ Approve or reject — the run only continues on approval
- ✓ Every decision attributed to who made it, and when
- ✓ Route different approvals to different people by step
- ✓ Ideal gate before payments, sends, and AI-driven actions
Every person gets exactly the control they should.
Building a process, running it, editing it, and managing who else can are four different powers. flow8 keeps them separate. Roles are scoped to the company entity, so one business unit can't see or trigger another's processes — and access is enforced at the API layer, not just hidden in the interface.
- ✓ Distinct permissions for view, run, edit, and admin
- ✓ Company-scoped multi-tenancy — units stay isolated
- ✓ Access enforced at the API level, not just the UI
- ✓ Denied actions are logged, not silently dropped
- ✓ OAuth2 / SSO support for enterprise identity
Every decision leaves a record you can answer with.
Governance only counts if you can prove it held. flow8 records the events that matter — access granted and denied, approvals decided, entities changed, processes triggered — each with the actor, source, and timestamp. When an auditor or a board asks who authorized something, you don't reconstruct it. You export it.
- ✓ Structured events: access, auth, entity, and module activity
- ✓ Access-denied attempts recorded, not just successes
- ✓ Actor, IP, and timestamp on every entry
- ✓ Sensitive fields sanitized automatically in records
- ✓ Configurable retention with enforced minimums
Control at every stage of the process.
Governance isn't one gate at the end. It's applied from who builds a process to how long its record is kept.
Who can build
Only roles with edit rights can create or change a process. Building is separated from approving and running.
Who can run
Run rights are granted per role and scope. Triggering a process is its own permission, logged on every execution.
Who must sign off
Sensitive steps pause for a named approver. The decision — yes or no — is recorded against the person who made it.
What is recorded
Every step, decision, and access event is kept with actor and timestamp, under retention rules you set.
The controls auditors and boards ask for.
flow8 gives you the building blocks of a governance program — without sending a single record to a vendor.
flow8 runs on your infrastructure, so the controls — and the evidence they produce — stay entirely under your authority. Nothing is processed, approved, or stored by a vendor with access to your records. Your governance obligations stay yours to demonstrate, on your own systems.
Show your board the controls.
Book 30 minutes and we'll walk through how approvals, roles, policy, and the audit trail work together — and how they'd map to the controls your organization has to demonstrate.