Organisation separation
Every session and operation belongs to one organisation and approved application.
No caller-selected tenant scopeHow it works
One request. Four boundaries. No implicit trust.
Your application identifies the customer and the business purpose. Piipe verifies the request, applies policy, protects the record and produces evidence of the result.
The request path
From business workflow to protected identity.
Each stage has one clear job. A failed check stops the operation instead of silently bypassing protection.
- 01YOUR APPLICATIONName the customer and purpose
Send an opaque customer reference, requested operation and exact field selection from a trusted server workflow.
- 02IDENTITY & POLICYProve who and why
Piipe binds the request to the organisation, application, principal and approved purpose, then checks operation permissions.
- 03MINIMUM DISCLOSURESelect only the fields required
The request names the precise identity fields the workflow may receive.
- 04RECORD PROTECTIONCommit the complete change
Stores and updates behave as one operation, so an incomplete change never becomes the live record.
- 05AUDIT EVIDENCEAccount for the outcome
Piipe records the actor, purpose, operation and result without placing protected field values in the audit trail.
Customer safeguards
Every operation carries its own context.
Identity access is evaluated against who is calling, what they may do, why they need it and which fields they requested.
Explicit intent
Workflows identify the business purpose associated with identity access.
No purpose, no operationMinimum disclosure
Retrievals return only the approved fields named by the request.
No complete profile by defaultAccountable outcomes
Activity identifies the caller, purpose, operation and result.
No protected values in logsRecord lifecycle
Atomic changes, explicit retrieval and accountable deletion.
A PII record may contain any number of named fields while remaining one logical identity collection for your application.
An incomplete write never becomes the live record.
Integrity and permission checks must pass before fields return.
The prior live record survives a failed replacement.
Live access ends before retention cleanup proceeds.
Build against the boundary
Developer guide Integrate without redesigning your application.
Keep your customer ID and business schema. Move only the fields that directly identify a person.