As enterprises transition from simple AI chatbots to autonomous multi-agent systems, the primary challenge is not the technical capability of the models, but the establishment of architectural guardrails. These are essential to prevent uncontrolled AI actions without sacrificing operational speed. Organizations often struggle to scale automation because they lack a management framework that balances agent autonomy with strict business compliance. Consequently, businesses face two extremes: either slow processes requiring constant manual confirmation or risky AI operations executed in circumvention of business logic.
Reliable operation of multi-agent BPM systems is achieved not by limiting the intelligence of the agents themselves, but through rigorous architectural orchestration of the process in BPMN 2.0, the separation of business rules in DMN, and systematic access control at the platform level.
The phenomenon of Excessive Agency: why autonomous agents disrupt traditional automation
In the Top 10 Risk & Mitigations for LLMs and Gen AI Apps 2025 classification, OWASP identifies "Excessive Agency" as a critical security risk. This vulnerability arises when an autonomous agent is granted broader permissions than necessary or direct access to system functions without proper oversight.
Unlike traditional scripts that follow rigid algorithms, LLM agents possess a degree of freedom in choosing actions. If business rules and limits are embedded directly into the system prompt, a compromise risk emerges. By manipulating the context, an attacker can force an agent to perform an unauthorized action—such as approving a payment. Irresponsible AI can act against company policy if its authority is not constrained by an external orchestration engine.
From Human-in-the-loop to Human-on-the-loop: shifting the control paradigm
The traditional Human-in-the-loop approach requires every AI step to be verified by an operator. While safe, this negates the benefits of automation by creating an operational bottleneck. Modern management systems are shifting toward the Human-on-the-loop paradigm.
According to the Artificial Intelligence Risk Management Framework (AI RMF 1.0) from NIST, AI risk management should be structured through Govern, Map, Measure, and Manage functions, ensuring accountability and model reliability. Exception-based management allows agents to execute standard steps autonomously, with escalation to a human occurring only during deviations. Operational models indicate that such a framework can leave approximately 13% of specific or high-risk transactions for human oversight, while others are executed automatically. This enables up to a 49% increase in end-to-end process speed while maintaining a robust level of governance.
The architectural security triangle: BPMN, DMN, and isolated AI services
To build a scalable system, it is necessary to clearly define areas of responsibility. This architectural "triangle" relies on the following components:
- BPMN 2.0: An open, executable standard that allows a single model to simultaneously document and manage process execution. The BPMN engine serves as the single source of truth for process states, preventing AI agents from arbitrarily altering stages.
- DMN (Decision Model and Notation): Separates business rules from the process flow. Decision tables, limits, and authority matrices exist independently of code and prompts, simplifying logic updates without changing the routing model itself.
- Isolated AI services: Agents act only as executors of narrow service tasks, devoid of direct access to transactional databases.
A real-world example: an AI agent processing invoices reads the amount and details, yet it is restricted by a DMN table that blocks automatic payment approval above a set limit. If the amount is higher, DMN automatically redirects the route in BPMN to a manual approval step, neutralizing the risk of Excessive Agency at the base architectural level.
Platform-level protection: system guardrails in UnityBase and Scriptum
BPMN and DMN are orchestration tools that require a reliable technological foundation. In the enterprise segment, these tasks are addressed through platform solutions such as the low-code platform Scriptum, which runs on UnityBase. UnityBase (a joint development by companies within the Intecracy Group) acts as a full-stack JavaScript framework for building systems with high security requirements.
For AI agent integration, UnityBase provides system guardrails:
- RBAC (Role-Based Access Control) and RLS (Row-Level Security): An agent is assigned a narrow system role. Even if a prompt is compromised, the AI physically cannot read or modify database records to which it lacks row-level access.
- Domain metadata: All interactions pass through a unified domain metadata model, which generates REST API and strictly controls authorized entity attributes.
The Scriptum platform, acting as an orchestrator, launches agents only as isolated Service Tasks within BPMN schemes, reinforcing process logic with UnityBase-level system protection.
Monitoring and audit: detecting deviations through Process Mining
The behavior of LLM models remains probabilistic, so the architecture requires constant monitoring. According to Process Mining approaches, the analysis of event logs is used to detect shadow processes or deviations from standard operational models.
The process engine logs every agent action in a secure system audit trail. Process Mining tools allow for tracking whether an agent is attempting to exceed its authority or access atypical API endpoints, which instantly signals the security management system that intervention is required.
| Architecture Layer | Main Function | Guardrail |
|---|---|---|
| Orchestration Layer (BPMN Engine) | Defines step sequence, records process state transitions, calls agents as services. | Prevents chaotic business logic changes by the agent, controls the route. |
| Business Rules Layer (DMN) | Stores decision tables, limits, and authority matrices separately from prompts. | Prevents unauthorized transaction approval by the agent. |
| Platform Layer (RBAC/RLS) | Limits agent access rights to the database at the row level, maintains system audit. | Blocks agent attempts to read or modify unauthorized data. |
| Execution Layer (AI Agent) | Processes unstructured data, classifies requests, prepares drafts. | Ensures execution autonomy only within the scope of an isolated step. |
Distributing responsibility between AI executors, BPMN/DMN engines, and a secure platform allows enterprise companies to safely scale process automation without the risk of losing control.
FAQ
How can Excessive Agency be prevented in AI agents?
Preventing Excessive Agency is achieved through architectural separation: an AI agent should not have direct access to APIs or databases. Its actions are orchestrated by a BPMN engine, and business rules are strictly controlled via DMN tables and platform-level system restrictions (e.g., RBAC/RLS).
What is the difference between Human-in-the-loop and Human-on-the-loop approaches?
In the Human-in-the-loop model, a human verifies every AI action before execution, which slows down the process. In the Human-on-the-loop model, the AI performs operations autonomously, and a human is involved only for exceptions when the process deviates from DMN rules or high-risk scenarios arise.
How can AI agents be integrated into enterprise systems based on UnityBase?
AI agents are integrated as isolated steps (Service Tasks) within BPMN processes, for example, in the low-code platform Scriptum. UnityBase assigns the agent a restricted system role with clear row-level security (RLS) access rights, and all actions are recorded in a secure audit log.