Signing inside the workflow.
Integrating signatures with external workflow engines.
In many organizations, signing is not the process: it is one step within a larger process. A request comes in through a form, data is looked up in another system, a document is generated, signed, archived, and someone is notified. More and more, that larger process is designed by the organization itself in an external workflow engine, without writing code. The question is how signing fits into that world.
Two responsibilities, two tools
| Workflow engine | Signing platform | |
|---|---|---|
| Knows how to | Connect hundreds of applications and move data between them. | Identify, sign, timestamp, validate and store evidence. |
| Decides | What happens before and after the signature. | How signing is done and what can be proven. |
| Should not | Handle keys or build evidence. | Replace the engine for general integrations. |
The typical mistake is to mix up the roles: having the workflow engine "sign" by pasting an image, or having the signing platform try to be a universal integrator. Each should do what it does well and communicate with the other through clear contracts.
The integration pattern
- An action to request. The engine creates a signing process with the document, the signers and the options, through the platform's interface.
- An idempotency key. If the engine retries, the platform recognizes the request and does not create a second process.
- A trigger to wait on. The platform sends a signed event when the document has been signed, declined or has expired.
- Event verification. The engine checks the notification's signature and age before continuing.
- The document and its evidence. The engine downloads the result and takes it wherever it needs to go.
Why no code matters
Workflow engines let an operations team, a school or a municipality build their own processes without waiting for a development project. If signing is available as just another building block, with its complete evidence, high level signatures reach processes that would never otherwise have had them.
The workflow engine decides what happens before and after; the signing platform decides how signing is done and what is proven. They integrate through an idempotent action to make the request, a signed event to send notice, and verification of that event. That is how high level signatures reach processes the organization builds itself.