Salanor DocsAegis · APS-1

n8n & orchestrators

Signed APS-1 traces and live policy checks in n8n — without Ed25519 private keys in the orchestrator.

Customer install (n8n): Settings → Community nodes → Install n8n-nodes-salanor-aegis → add credential → use Salanor Aegis (Record Run at the end; Check Policy before risky tools).

1. Install the Salanor node

  1. In n8n: Settings → Community nodes → Install
  2. Package: n8n-nodes-salanor-aegis
  3. Accept the community-node risk prompt and install
  4. Create credential Salanor Aegis API: base URL https://api.salanor.com, ingest API key from the console
  5. Console → Agents → Enable Workflow Bridge (must show Workflow Bridge on)

2. Workflow shape

Product pattern
Trigger
  → … your nodes …
  → Salanor Aegis · Check Policy     # before payment / delete / send / apply
  → risky tool (only if allowed)
  → …
  → Salanor Aegis · Record Run       # once at the end → signed trace + trace_url

Record Run is one call: Salanor starts, signs packed steps, and completes the trace. You do not call Aegis on every node. Check Policy is what can block an action before it runs.

One trace per run

  • Allow — Check Policy returns the decision only; Record Run writes one COMPLETED trace (policy gate embedded in that trace).
  • Deny — Check Policy writes one FAILED trace and stops the workflow.
  • Require approval — Check Policy opens a blocked trace and approval in Console; after approval, Record Run completes that same trace.

Wire an Error Trigger → Record Run (Failed) so crashes still leave a signed trace. See the community node README example workflow.

3. Zapier / Make / plain HTTP

Same server API. One POST at the end (and optional policy evaluate before risk):

POST https://api.salanor.com/v1/aegis/workflows/runs
curl -X POST https://api.salanor.com/v1/aegis/workflows/runs \
  -H "Authorization: Bearer $AEGIS_INGEST_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "one_shot": true,
    "business_context": "Content sync",
    "external_system": "zapier",
    "status": "completed",
    "execution": {
      "workflow_name": "Content Sync",
      "nodes": [
        { "name": "LLM", "kind": "llm", "output_preview": "…" },
        { "name": "Apply", "kind": "tool", "tool_name": "app.content.apply", "status": "success" }
      ]
    }
  }'

4. Verify

Open trace_url in Console → Traces. Status should be COMPLETED with signed steps (not stuck on aegis.trace.start only).

When to use the SDK instead

In-app agents (Node/Python) that must evaluate policy inside code: use @salanor/aegis. Orchestrators use this page. Same console.

Next