Skip to content
Security · Governance · Product boundaries

Control stays with you.

How Obsinto accesses systems, uses AI, authorizes actions, and preserves the record. These boundaries are updated as the product develops.

Last updated: August 2026
Boundary 01

Access Model: Read, approval, and write authority are distinct.

Obsinto separates what a person or system can observe from what it can approve, and from where an approved action can actually be carried out.

Supported integrations
Requested permissions
Read-only access
Write-capable actions
Credential storage & revocation
Approval before write actions
Action scope
Tenant isolation
Boundary 02

Human Authorization: Material decisions retain accountable ownership.

Consequential compliance decisions are routed through accountable owners, with the context available at decision time preserved alongside the outcome.

Approval roles & thresholds
Rejection & exception handling
Re-authorization rules
Attribution of decisions
Immutable audit history
Boundary 03

AI Governance: AI operates inside defined governance boundaries.

AI-generated analysis and proposed actions operate inside the defined access and approval boundaries. Material decisions and write actions require the approvals assigned to them.

Model providers used
Data retention policy
Model-training policy
Grounding sources for AI
Boundaries on AI recommendations
Boundaries on AI actions
Mandatory human review points
Known limitations

Review the details with us.

The topics above outline what to review during security due diligence. For the current integration permissions, model providers, retention terms, or product limitations relevant to your deployment, contact our team. This page is not a certification or independent assurance report.

Request security information
Auditability

Preserve the history behind the resulting state.

Where supported, the operating record retains a chain from source condition to resulting state.

Auditability & Traceability

10-Step Auditability Lineage Trace

IMMUTABLE TRACE
01
Source condition identified14:02:11 UTC
System: AWS Security Signal
02
Affected requirement evaluated14:02:24 UTC
System: Obsinto Engine
03
Compliance impact calculated14:03:01 UTC
System: Program Baseline
04
Evidence references bound14:03:15 UTC
System: Evidence Layer
05
Proposed action generated14:03:40 UTC
System: Remediation Workflow
06
Approver routed & verified14:05:12 UTC
System: Microsoft Entra ID
07
Timestamped decision authorized14:05:18 UTC
System: Security Lead (Human)
08
Implementation record committed14:12:04 UTC
System: GitHub PR Commit
09
Re-test executed against baseline14:12:45 UTC
System: Automated Inspector
10
Resulting state verified14:13:02 UTC
System: Program Audit Record VERIFIED STATE