§ Integrations & StandardsDocument · REG-INT-2026.04

Regisseur deploys above your existing stack.

Every external interaction flows through a registered, workspace-scoped tool or provider: revocable, testable, and audited at the call site.

§ 01 — Integration primitives

Any system of record. Bounded by MCP.

Integration surfaces — inbound paths (signed webhooks, monitored mailboxes, SFTP and flat files, public intake portals) and outbound paths (REST and MCP tool calls, model-provider calls, mail and notification relays), every connection named, credentialed, workspace-scoped, and audited at the call site.
Integration surfacesInbound and outbound paths — every one authenticated and audited
System of record
Read where it lives
No shadow repository

Regisseur reads documents, records, tickets, and work items through registered tools. Source systems stay authoritative.

Every retrieval is an audited MCP call; every token is workspace-scoped and revocable.

ProtocolMCP · service token
ScopeWorkspace · object-level
RevocationIndependent
AuditPer-call · ledgered
Structured intake
Typed payloads
Native mappings

Regisseur normalizes domain payloads into typed work attributes for downstream steps.

Payload lineage is preserved end-to-end — every derived value links back to its source field.

IngestNative
MappingTyped attributes
LineageEnd-to-end
Decision rules
Policy gates
Runtime-enforced

Domain rules compile into process gates. Violations fail closed and cite the blocking criterion.

Rules are versioned — in-flight work finishes on the rule set that was live when the work started.

EnforcementEngine-level
VersioningSCD Type 2
ReplayByte-identical
§ 02 — MCP registry

Zero-trust external access. Registered, scoped, revocable.

workspace · operations · mcp registry7 servers · 16 tools · all workspace-scoped
ServerPurposeScopeAuthStatus
document.systemWorkspace document retrievalWorkspace · readService token · rotated 30dLive
structured.intakeTyped intake payload ingestionWorkspace · writeMutual TLSLive
rules.engineDomain rule lookup and validationOrg · read · versionedService tokenLive
calculation.serviceScored recommendations and calculationsWorkspace · readService tokenLive
twilio.outboundTokenized SMS to external partiesWorkspace · write · signedSignature verificationLive
signing.providerEmbedded signing envelopes and PDFsWorkspace · writeProvider credentialLive
system.writebackApproved outcome writebackWorkspace · writeService token · 2-factorStaging

Every MCP call is logged with arguments, result hash, trace_id, and policy decision. Agents cannot invoke servers not registered in the workspace.

§ 03 — Workspace providers

Outbound systems are configuration, not code forks.

Mail

SMTP default · Microsoft Graph · SendGrid

Invitations, follow-ups, and signing links use the workspace-selected mail path.

Test connection
Messaging

Twilio · REST gateway

SMS and gateway delivery stay bounded by a provider contract and signed outbound call model.

Test connection
Signing

DocuSeal default · DocuSign option

Embedded signing creates an auditable pause and resumes the workflow on completion.

Test connection
Error reporting

Sentry · GlitchTip

Operational evidence can route to the customer-approved reporting provider.

Test connection
§ 04 — Systems of record

Unchanged. Unmoved. Undisturbed.

Systems of record, document stores, CRMs, ticketing queues, billing systems, and data warehouses stay put.

Regisseur reads what it needs, writes what it’s allowed, and leaves the rest alone. Domain experts update Tier 2 agent logic; the Tier 1 engine stays locked; Tier 3 packages carry domain rules.

§ 05 — How work starts, and how it chases

The start-side and the reach-out side.

Event-driven intake

Webhooks and event sources (HRIS, ServiceNow, messaging, and more) start the right case automatically — the trigger payload mapped onto case data from the first moment.

Multi-channel outreach

Cases reach out over email and SMS through your own providers; message-correlated replies route back to the right case.

The follow-up agent

When a case is waiting on an outside party, an autonomous follow-up agent chases the response on a schedule — under review where review is required.

How work starts, and how it chases →
§ 06 — Connectors

Meet systems where they are.

Modern systems get MCP and REST. Thirty-year-old systems get SFTP and a mailbox. Both are first-class — named, credentialed connections, without code.

Modern
REST APIs

Generic REST connections to any HTTP system — configured, credentialed, and tested per workspace, with no integration to build.

Every call is workspace-scoped and audited at the call site.

AuthOAuth2 · API-key · bearer · basic
PayloadsJSON
ScopeWorkspace
AuditPer-call
Legacy
SFTP + flat files

The format legacy systems actually speak: CSV and fixed-width files over SFTP, inbound and outbound.

Records map onto typed case attributes on the way in; generated files on the way out.

TransportSFTP
FormatCSV · fixed-width
DirectionIn / out
MappingTyped attributes
Email-driven
Monitored mailboxes

Point a process at a mailbox and it starts the moment a message arrives — the email parsed into a structured case.

Replies correlate back to the case that sent them.

TriggerInbound email
ParseStructured case
ScopePer mailbox
CorrelationReply → case
The Settings → Connectors page with three live connectors — a REST lab-vendor (API-key), an SFTP mvr-batch-feed (CSV, per-row), and a Graph-monitored intake mailbox — each with Test, Rotate, and Deactivate actions.
Connectors, configuredREST, SFTP, and a monitored mailbox — named, credentialed, testable
§ Next step

Map your stack to Regisseur in 30 minutes.

Bring one process, the systems it touches, provider requirements, and the review gates that keep it safe. We’ll sketch the MCP registry, the provider layer, the autonomy ceilings, and the first workflow you could run by week four.

Book the mapping session →Read the governance model
Boundary
MCP-bounded tools
Standard
Typed payloads
Floor
Runtime policy gates
Time to live
Weeks, not months