diff --git a/app/boot_levels.go b/app/boot_levels.go
index 80573ca0e..993ddbbc9 100644
--- a/app/boot_levels.go
+++ b/app/boot_levels.go
@@ -274,6 +274,7 @@ func (app *CortezaApp) InitServices(ctx context.Context) (err error) {
 	err = autService.Initialize(ctx, app.Log, app.Store, autService.Config{
 		ActionLog: app.Opt.ActionLog,
 		Workflow:  app.Opt.Workflow,
+		Corredor:  app.Opt.Corredor,
 	})
 
 	if err != nil {
diff --git a/automation/service/registry.go b/automation/service/registry.go
index 9df2afb9e..922be0fd3 100644
--- a/automation/service/registry.go
+++ b/automation/service/registry.go
@@ -61,7 +61,9 @@ func (r registry) Functions() []*types.Function {
 		ff = make([]*types.Function, 0, len(r.functions))
 	)
 
-	for ref := range r.functions {
+	for ref, f := range r.functions {
+		// flag for UI weather this function step is disabled or not
+		f.Disabled = !DefaultWorkflow.corredorOpt.Enabled && ref == "corredorExec"
 		rr = append(rr, ref)
 	}
 
diff --git a/automation/service/service.go b/automation/service/service.go
index 89e1e7d01..ba75cc5fc 100644
--- a/automation/service/service.go
+++ b/automation/service/service.go
@@ -26,6 +26,7 @@ type (
 	Config struct {
 		ActionLog options.ActionLogOpt
 		Workflow  options.WorkflowOpt
+		Corredor  options.CorredorOpt
 	}
 
 	userService interface {
@@ -93,7 +94,7 @@ func Initialize(ctx context.Context, log *zap.Logger, s store.Storer, c Config)
 	DefaultAccessControl = AccessControl(rbac.Global())
 
 	DefaultSession = Session(DefaultLogger.Named("session"), c.Workflow)
-	DefaultWorkflow = Workflow(DefaultLogger.Named("workflow"), c.Workflow)
+	DefaultWorkflow = Workflow(DefaultLogger.Named("workflow"), c.Workflow, c.Corredor)
 	DefaultTrigger = Trigger(DefaultLogger.Named("trigger"), c.Workflow)
 
 	DefaultWorkflow.triggers = DefaultTrigger
diff --git a/automation/service/workflow.go b/automation/service/workflow.go
index 741c9b213..9717e4b65 100644
--- a/automation/service/workflow.go
+++ b/automation/service/workflow.go
@@ -2,6 +2,7 @@ package service
 
 import (
 	"context"
+	"github.com/cortezaproject/corteza-server/pkg/options"
 	"reflect"
 	"sync"
 
@@ -14,7 +15,6 @@ import (
 	"github.com/cortezaproject/corteza-server/pkg/filter"
 	"github.com/cortezaproject/corteza-server/pkg/handle"
 	"github.com/cortezaproject/corteza-server/pkg/label"
-	"github.com/cortezaproject/corteza-server/pkg/options"
 	"github.com/cortezaproject/corteza-server/pkg/rbac"
 	"github.com/cortezaproject/corteza-server/pkg/wfexec"
 	"github.com/cortezaproject/corteza-server/store"
@@ -38,7 +38,8 @@ type (
 		wfgs map[uint64]*wfexec.Graph
 
 		// workflow function registry
-		reg *registry
+		reg         *registry
+		corredorOpt options.CorredorOpt
 
 		mux    *sync.RWMutex
 		parser expr.Parsable
@@ -80,20 +81,21 @@ const (
 	workflowDefChanged    workflowChanges = 4
 )
 
-func Workflow(log *zap.Logger, opt options.WorkflowOpt) *workflow {
+func Workflow(log *zap.Logger, opt options.WorkflowOpt, corredorOpt options.CorredorOpt) *workflow {
 	return &workflow{
-		log:       log,
-		opt:       opt,
-		actionlog: DefaultActionlog,
-		store:     DefaultStore,
-		ac:        DefaultAccessControl,
-		triggers:  DefaultTrigger,
-		session:   DefaultSession,
-		eventbus:  eventbus.Service(),
-		wfgs:      make(map[uint64]*wfexec.Graph),
-		mux:       &sync.RWMutex{},
-		parser:    expr.NewParser(),
-		reg:       Registry(),
+		log:         log,
+		opt:         opt,
+		actionlog:   DefaultActionlog,
+		store:       DefaultStore,
+		ac:          DefaultAccessControl,
+		triggers:    DefaultTrigger,
+		session:     DefaultSession,
+		eventbus:    eventbus.Service(),
+		wfgs:        make(map[uint64]*wfexec.Graph),
+		mux:         &sync.RWMutex{},
+		parser:      expr.NewParser(),
+		reg:         Registry(),
+		corredorOpt: corredorOpt,
 	}
 }
 
diff --git a/automation/service/workflow_actions.gen.go b/automation/service/workflow_actions.gen.go
index 6e00f89b2..4babbe30b 100644
--- a/automation/service/workflow_actions.gen.go
+++ b/automation/service/workflow_actions.gen.go
@@ -914,6 +914,38 @@ func WorkflowErrMaximumCallStackSizeExceeded(mm ...*workflowActionProps) *errors
 	return e
 }
 
+// WorkflowErrNotAllowedToExecuteCorredorStep returns "automation:workflow.notAllowedToExecuteCorredorStep" as *errors.Error
+//
+//
+// This function is auto-generated.
+//
+func WorkflowErrNotAllowedToExecuteCorredorStep(mm ...*workflowActionProps) *errors.Error {
+	var p = &workflowActionProps{}
+	if len(mm) > 0 {
+		p = mm[0]
+	}
+
+	var e = errors.New(
+		errors.KindInternal,
+
+		p.Format("not allowed to run corredorExec function, corredor is disabled", nil),
+
+		errors.Meta("type", "notAllowedToExecuteCorredorStep"),
+		errors.Meta("resource", "automation:workflow"),
+
+		// action log entry; no formatting, it will be applied inside recordAction fn.
+		errors.Meta(workflowLogMetaKey{}, "failed to execute {workflow} with corredorExec function step; corredor is disabled"),
+		errors.Meta(workflowPropsMetaKey{}, p),
+
+		errors.StackSkip(1),
+	)
+
+	if len(mm) > 0 {
+	}
+
+	return e
+}
+
 // *********************************************************************************************************************
 // *********************************************************************************************************************
 
diff --git a/automation/service/workflow_actions.yaml b/automation/service/workflow_actions.yaml
index 972ce6db9..e0bdd3368 100644
--- a/automation/service/workflow_actions.yaml
+++ b/automation/service/workflow_actions.yaml
@@ -111,3 +111,7 @@ errors:
   - error: maximumCallStackSizeExceeded
     message: "maximum call stack size exceeded"
     log: "maximum call stack size exceeded"
+
+  - error: notAllowedToExecuteCorredorStep
+    message: "not allowed to run corredorExec function, corredor is disabled"
+    log: "failed to execute {workflow} with corredorExec function step; corredor is disabled"
diff --git a/automation/service/workflow_converter.go b/automation/service/workflow_converter.go
index 31ec1e334..c7015c97f 100644
--- a/automation/service/workflow_converter.go
+++ b/automation/service/workflow_converter.go
@@ -567,6 +567,14 @@ func verifyStep(s *types.WorkflowStep, in, out types.WorkflowPathSet) types.Work
 			return nil
 		}
 
+		// check for corredor function step(s) are allowed or not
+		checkDisabledFunc = func() error {
+			if !DefaultWorkflow.corredorOpt.Enabled && s.Ref == "corredorExec" {
+				return WorkflowErrNotAllowedToExecuteCorredorStep()
+			}
+			return nil
+		}
+
 		// checks if argument is present
 		checkArg = func(argName string, typ expr.Type) func() error {
 			return func() error {
@@ -664,6 +672,7 @@ func verifyStep(s *types.WorkflowStep, in, out types.WorkflowPathSet) types.Work
 	case types.WorkflowStepKindFunction:
 		checks = append(checks,
 			requiredRef,
+			checkDisabledFunc,
 			count(0, 1, outbound),
 		)
 
diff --git a/automation/types/function.go b/automation/types/function.go
index ec82f9c61..d1a51c747 100644
--- a/automation/types/function.go
+++ b/automation/types/function.go
@@ -25,7 +25,8 @@ type (
 		Handler  FunctionHandler `json:"-"`
 		Iterator IteratorHandler `json:"-"`
 
-		Labels map[string]string `json:"labels,omitempty"`
+		Labels   map[string]string `json:"labels,omitempty"`
+		Disabled bool              `json:"disabled,omitempty"`
 	}
 
 	FunctionMeta struct {
diff --git a/vendor/modules.txt b/vendor/modules.txt
index ea21c488e..e5693541c 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -212,6 +212,10 @@ github.com/prometheus/common/model
 # github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084
 github.com/prometheus/procfs
 github.com/prometheus/procfs/internal/fs
+# github.com/russellhaering/goxmldsig v1.1.0
+github.com/russellhaering/goxmldsig
+github.com/russellhaering/goxmldsig/etreeutils
+github.com/russellhaering/goxmldsig/types
 # github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd
 ## explicit
 github.com/rwcarlsen/goexif/exif