Guided onboarding¶

The guided setup at https://app.venturi.systems/domains/adoption/onboarding lets an authorized developer, Engineer, or Admin reach active use within ≤30 minutes through a connected evidence source or a provider export upload. Venturi tenant, connector, federation, and external-ID setup artifacts are generated in-product. Customer-provided provider-account credentials or provider exports are entered in-product. Credentials remain tenant-local and are validated for read-only access wherever the provider offers read-only credentials. No Venturi-human response or emailed setup value is required. See Docs authority & product state.

SaaS verification uses the quality feed. For self-hosted deployments, use the same /domains/quality/feed path on your own instance host. Attributable records appear on the /invocations surface; the quality feed is where you verify them.

Ordered setup path¶

Complete the steps in order. Each page names the required role, task, success evidence, and recovery action.

IdP federation in step 1 controls sign-in. The identity-resolution connector in step 3 supplies attribution evidence. They are separate controls.

Choose a cloud connector¶

AWS: cross-account IAM role with external-ID scoping.
Google Cloud: Workload Identity Federation with no exported keys.
Azure: federated identity credential with no client secret by default.

Cloud onboarding uses no long-lived cloud credentials by default. The optional Azure client-secret fallback is the only cloud exception: the secret has a 90-day TTL and its value is stored in Terraform state, so protect that state and enter the value only through the encrypted in-product connector form, never by email or in a support case. Provider-account credentials for SaaS connectors remain valid until you rotate or revoke them, and a Venturi API key remains valid until it expires or you rotate or revoke it, so scope each credential narrowly and rotate it on a schedule. Venturi stores provider-account credentials as encrypted credential references. See Trust & security.

Every connector only reads. Before activation, automated validation checks credentials, trust conditions and expected reads. Verify write refusal with policy simulation or an isolated provider test fixture; never issue an administrative write against production data. OpenAI organization Admin keys support selectable read permissions. Anthropic reporting credentials can carry wider capability, so both connectors independently restrict requests to GET on the approved endpoint allowlist. See the provider credential matrix. If an isolated negative test unexpectedly permits a write, validation fails and the connector stays inactive until the excess capability is removed or its required independent egress enforcement passes verification.

Success evidence¶

The engineering active-use milestone is reached when at least 1 source or file is accepted and its 1st AttributionRecord is visible in the quality feed with coverage, unknown-state, and freshness evidence.

Persona-complete production onboarding additionally requires Product, Security, Engineering, and Finance paths to advance through real in-product actions, including Finance acceptance of a chargeback-eligible export. There is no admin or support override.

Recovery¶

Use the failed validation result to return to the responsible step. Rotate or revoke credentials in-product when trust is uncertain. Support is an optional escalation path, never a prerequisite.

Give feedback on this page

Sign in to send feedback. Opens in a new tab.

Copy page details

Docs feedback: Guided onboarding
Page: https://docs.venturi.systems/onboarding/