Platform integration

How Dexter runs in the platform

When a user clicks "Fix" on a finding in the Cybrium workspace:

1. Dexter generates a fix preview (dry-run) showing what will change
2. If approval is required, an email is sent to tenant admins
3. Once approved, Dexter captures the current resource state
4. The fix is applied in an isolated, auditable environment
5. Post-fix state is captured and compared
6. The finding is re-scanned to verify resolution
7. Email notification with result and rollback option

Credential separation

Cybrium enforces strict separation between scan and fix credentials:

Scope	Access	Purpose
Scan	Read-only	Reconnaissance, assessment, configuration reads
Fix	Write	Applying remediations, modifying cloud resources

Scan credentials can never be used to apply fixes. Each scope is configured separately in Settings > Cloud Providers.

Approval gates

Dexter supports configurable approval workflows:

1. Dry-run first — Dexter generates the fix plan without applying
2. Admin review — the fix plan is emailed to tenant admins with a preview of changes
3. Explicit approval — an admin approves in the Cybrium console
4. Apply + verify — fix is applied and automatically verified
5. Rollback window — 24-hour window to reverse any applied fix

With Cymind consciousness level 3 or above, low-severity fixes can be auto-approved — skipping the manual gate while maintaining full audit trail.

CI/CD integration

Dexter can also be triggered from your CI/CD pipeline:

# Scan and auto-fix in one step (dry-run by default)
cybrium scan --target my-aws-account --auto-fix --dry-run

Fix proposals from CI runs appear in your Cybrium workspace for review.