TechPrufer
Get started
Temporal
Temporal logoTemporal · Feature trail

Activity Isolation for Security

3 posts · Oct 2025 – Oct 2026

What this trail covers

Temporal Cloud offers a layered approach to data security, including TLS for data in transit and application-level encryption via Payload Codecs for data at rest. This ensures that the Temporal Service only sees encrypted data, with keys managed externally. The integration of Oso enhances AI agent security by providing native identity propagation and policy enforcement within the execution platform, ensuring that authorization controls hold up through failures and retries.

All Temporal trails
  1. Accelerating AI agent security — Welcome Oso teamThe acquisition of the Oso team will accelerate Temporal's work in AI agent security by integrating native identity propagation and policy enforcement into the execution platform. This builds upon Temporal's existing Durable Execution capabilities, which preserve application state and execution history through failures and retries, ensuring that approvals and rejections remain intact. The focus is on extending authorization work to address the risks associated with AI agents acting on vital data and chaining calls across services, ensuring that agent authority is bounded and traceable to the identity that allowed it.
  2. Using Activity isolation as a security boundaryThis post details how keeping PII scan, classification, and storage within a single Activity enforces a security boundary, preventing raw PII from crossing Activity boundaries or appearing in the Temporal UI. It also covers using heartbeating for long-running streaming Activities to detect stuck workers and resume processing from the last checkpoint, and employing a DataStore contract for swappable storage implementations.
  3. How to protect sensitive data in a Temporal ApplicationThis post details how to protect sensitive data in Temporal applications by explaining the data flow between requesters, the Temporal Service, and Workers. It covers protecting data in transit using TLS and data at rest using application-level encryption via Payload Codecs. The post elaborates on the roles of Data Converters, Payload Converters, Failure Converters, and Payload Codecs in serializing, deserializing, and transforming data, with a focus on using Payload Codecs for encryption to ensure the Temporal Service only sees encrypted data and that keys are managed externally.