Workflow Security

Workflow security encompasses the controls and practices that protect automated business processes from unauthorized access, manipulation, and data breaches. In AI governance contexts, this becomes critical as machine learning workflows often handle sensitive data, integrate multiple systems, and execute decisions that affect customers or operations. Organizations must implement authentication, encryption, audit trails, and access controls throughout their AI pipelines to ensure compliance with regulations like GDPR and prevent unauthorized model modifications that could compromise decision integrity.

1 item

ResearchGlobal2026-09-10

Workflow Identity Hijacking Bypasses Every Existing Agent Authorization Control

Noma Labs researcher Sasi Levi has documented a technique called workflow identity hijacking, in which unauthenticated or low-privilege users trigger privileged AI workflows simply by submitting benign inputs through entry points such as support inboxes or web forms. The core flaw is a structural decoupling between the identity of the person who initiates a workflow and the identity used to execute downstream actions, allowing AI pipelines to proxy high-privilege service accounts without verifying the original requester's authorization. Standard prompt-injection defenses and conventional security monitoring do not detect this class of attack, because the executing service account is behaving as its configuration intends.

agentic AI identity and access management authorization controls AI pipeline security Noma Labs privilege escalation workflow security