- Developer runs a CF push command
- Meta buildpack is invoked and claims the build
- Meta buildpack invokes the relevant language buildpack
- Language buildpack claims the build and produces a droplet
- Meta buildpack invokes the Aqua Decorator
- Droplet contents are scanned by the Aqua Decorator; scan results are displayed in the Aqua dashboard/CI tool
- If droplet complies with the droplet Assurance Policy, the droplet is approved and an application is created
- User defines runtime policies in the Aqua console
- Policies are enforced in runtime by the Aqua agent installed as a BOSH add-on