Open-source report-resolution workflows

Design how every
report gets resolved.

Safest Resolve keeps each accepted report with its evidence, owner, decision, application action, messages, and appeal. Your team defines the route and the points where a person must decide.

Apache-2.0 licensed. Runs in your Cloudflare account.

Workflow Studio Run evidence checks in parallel, require human review, then deliver the approved action and message

The report workflow

Keep the report, evidence, decision, action, and appeal together.

Every step adds to the report that started the work, so an operator can see what happened and why.

  1. 1

    Accept

    Store reports from your product, a public form, or the server API, then return a tracking reference.

  2. 2

    Route

    Run the published routing rules, assign a queue, and record why the report went there.

  3. 3

    Work

    Collect the evidence the policy asks for, assign human review where required, and record the decision.

  4. 4

    Finish

    Wait for the application to confirm the action, send the right updates, and keep any appeal with the original report.

Inside Safest Resolve

See the queue, the report record, and its current owner.

Open a report to review its evidence and policy, or move to routing, the read-only assistant, and team access from the same workspace.

Queues and live ownership

Know what is waiting and who is on it.

Filter reports by queue, priority, age, and state. Each row shows the current owner, who else is present, and which reports are still unclaimed.

  • Queue, priority, and age at a glance
  • Named owners with profile photos
  • Live presence beside unclaimed work
Product view Queues and live ownership

Report workspace

Make the decision with the whole record open.

Open a report to see the allegation, target, evidence references, policy version, timeline, conversation, and current claim. The owner requests context and records the decision there.

  • Evidence references and policy version
  • Claim owner and expiry
  • Conversation and decision controls
Product view Report workspace

Queues and routing policy

Publish the routing policy your team will run.

A routing version names the safeguard queue, default human queue, eligible queues, confidence threshold, instructions, and the exact fields AI may read. It also records the rollout and operating mode.

  • Human, AI, or hybrid ownership
  • Safeguard and default-human queues
  • Versioned routing and per-queue policy
Product view Queues and routing policy

Read-only assistance

Get cited answers without granting write access.

Ask questions about the workspace records your role can read. Factual answers cite their sources, database tools are read-only, and chat cannot deliver actions or publish changes.

  • Read-only, role-scoped tools
  • Citations for factual answers
  • No actions or publishing from chat
Product view Read-only assistance

People and roles

Tie every decision to a named person.

Owners, administrators, and analysts have named accounts and visible roles. Their names appear on presence, claims, decisions, actions, and audit entries.

  • Workspace-scoped roles
  • Profile photos in live work
  • Invitations and account recovery
Product view People and roles

Customer-owned deployment

Run Safest Resolve in your Cloudflare account.

The installer creates the runtime, storage, queues, workflow engine, and operating controls in your account.

Your application keeps its own data. Safest Resolve requests named fields through signed, versioned connections when a workflow needs them.

Safest Resolveinside your account

Runtime and state

WorkersAPIs, consoles and portals
Static AssetsAnalyst UI, report form, widget and reporter portal
D1Reports, policy versions and audit history
R2Profiles, evidence, workflow artifacts and exports
Durable ObjectsLive presence and renewable report claims

Durable execution

QueuesRouting, delivery, retries and dead letters
WorkflowsDurable steps, waits and human handoffs
Worker LoadersLoad each published workflow version
Cron TriggersReconciliation and scheduled maintenance
Workers AIPublished, queue-scoped assistance and routing

Security and operations

TurnstileBot protection for public report intake
Cloudflare AccessInfrastructure-owner bootstrap
Workers LogsRuntime logs and invocation visibility
Worker secretsSigning keys and integration credentials
Email ServiceOptional reporter updates from your domain

The setup plan names every resource before deployment.

Workflow safeguards

An accepted report stays open until the workflow records an outcome.

Store the report before starting work

Safest Resolve returns a tracking reference only after the report has been stored.

Send the hard calls to a person

Sensitive, uncertain, contested, and consequential decisions require an authorized reviewer.

Keep the original decision

An appeal adds a separate human review without rewriting the decision that came before it.

Use cases and implementation

Choose the guide that matches the job in front of you.

See complete report workflows, deployment steps, and the product integration from intake to action.

Start with one report

Walk us through one report path.

Tell us where the report enters your product, what evidence a reviewer needs, who decides, and what the product should do next. We will use that real path for the first conversation.

Read the source.The workflow runtime, deployment scripts, security boundaries, and current work are all on GitHub.
Open GitHub
Map one real report

Share the path as it works today. Friction, exceptions, and missing steps are useful.

Your email app opens next
Helpful details
  • Where it arrives
  • Evidence required
  • Who must decide
  • What happens next

Nothing is sent yet. We open a pre-filled email for you to review; this page does not store your answers.