Moving from generative AI experiments to deploying autonomous AI agents (agentic workflows) creates a critical challenge: how to grant an agent autonomy without the risk of unauthorized system actions. Businesses want to delegate routine operations to AI but face the dilemma of losing control over confidential data and the risk of the agent exceeding the authority of the employee it replaces.
AI agent security in corporate processes is achieved not by trying to make a Large Language Model (LLM) perfectly reliable, but by strictly limiting its actions within BPMN/DMN models and role-based access (RBAC/RLS) at the base platform level.
Anatomy of the excessive agency threat: why AI agents lose control
OWASP classifies "Excessive Agency" as a critical vulnerability for integrated LLM systems. This risk arises when an AI agent is granted overly broad rights to perform actions via API (e.g., executing transactions, changing database statuses) without proper external verification and restrictions.
AI models are inherently vulnerable to indirect prompt injection and hallucinations. If an agent analyzes an incoming document containing a hidden malicious instruction, it might attempt an unauthorized action, such as approving a financial transaction that exceeds a user's authority limit. Protection against this cannot rely solely on the model's system prompts (guardrails). Security must be controlled by an external orchestrator that restricts the agent's rights at the metadata level.
NIST AI RMF 1.0 concept: govern, map, measure, manage
To build a systematic risk management strategy, it is advisable to rely on the Artificial Intelligence Risk Management Framework (AI RMF 1.0) from NIST. This standard structures AI risk management around four main functions:
- Govern: Create an architectural culture where AI agents operate with clearly defined roles and mandatory action logging.
- Map: Identify decision-making contexts and classify risks. For example, the risk of sensitive information disclosure is treated as a high-priority threat at the architecture level.
- Measure: Assess agent reliability based on benchmark data and system logs.
- Manage: Implement technical access restrictions and isolate execution environments to minimize risks in real time.
Architectural barrier: integrating AI agents into BPMN 2.0 and DMN
The most effective method for controlling AI agent behavior is integrating them into BPMN 2.0 (Business Process Model and Notation) and DMN (Decision Model and Notation) standards. Instead of allowing the agent to independently determine the business process flow, the architecture is built by separating decision-making logic from the process engine.
In such an architecture, the AI agent acts solely as an executor of an isolated service task. The BPMN engine controls transitions between process steps. Business rule logic is moved to DMN tables, which define strict boundaries for actions. For example, if an AI agent attempts to offer terms that contradict corporate policies while processing customer requests, a DMN rule will instantly block the action because the agent physically lacks the authority to violate it.
Access control at the metadata level: the role of the UnityBase platform
A common mistake in many integrations is connecting an AI agent to corporate databases via a service account with broad rights, relying on prompt-based restrictions. This creates a direct risk of data leakage.
A reliable solution lies in restricting rights at the platform level. Building secure agentic workflows is possible using the low-code platform Scriptum or the electronic document management system Megapolis.DocNet, which are based on the mechanisms of the UnityBase platform (jointly developed by companies within the Intecracy Group alliance). UnityBase ensures metadata-level access control using Role-Based Access Control (RBAC) and Row-Level Security (RLS).
When an AI agent makes a request, UnityBase automatically filters data at the database query level based on the agent's system role. Data to which the agent has no access simply does not enter the LLM context. UnityBase does not make the language model itself error-free, but it creates a rigid external security perimeter that prevents unauthorized access to sensitive information.
Human-in-the-loop and process mining: audit and verification
For high-risk operations—such as approving financial decisions or signing legal documents—implementing "human-in-the-loop" control points is mandatory. In a BPMN process, an AI agent can prepare a document draft, but the final digital signature must be applied exclusively by a human. AI agents should not replace human judgment in critical compliance scenarios.
Process mining technology is used for continuous auditing of AI actions. By analyzing system log files, organizations can reconstruct the actual process flow. Since orchestrators record AI agent actions with the same granularity as human actions, process mining allows for the timely detection of deviations, "shadow routes," and attempts at automated abuse of authority.
Risk control matrix for AI agents in enterprise architecture
| OWASP risk class | Technical manifestation in workflow | Architectural mitigation method |
|---|---|---|
| Excessive Agency (LLM01:2025) | Agent executes an unauthorized transaction via API. | Restricting API call rights via RBAC; orchestrating steps exclusively via the BPMN engine. |
| Sensitive Information Disclosure (LLM02:2025) | Personal data leakage via prompt context. | Data filtering at the platform RLS (Row-Level Security) level before transmission to the LLM. |
| Indirect Prompt Injection (LLM05:2025) | Malicious instructions in an input document change agent logic. | Validating agent output via DMN decision tables and mandatory human-in-the-loop. |
In summary: reliable integration of AI agents requires abandoning the illusion of an "absolutely secure LLM." Real security is achieved by managing the execution environment—through business process orchestration, metadata-level platform access control, and human verification of critical transactions.
FAQ
How can I limit an AI agent's access rights to corporate databases?
Instead of trying to limit the agent with system prompts, you must use platform mechanisms (RBAC and RLS). For example, the UnityBase platform automatically filters data at the database query level based on the agent's role before the information enters the LLM context.
What is Excessive Agency in the context of OWASP Top 10 for LLM?
Excessive Agency is a critical risk where an AI agent is granted excessive authority to perform actions via API, allowing it to execute unauthorized transactions or modify data outside of its assigned business rules.
How can I implement human-in-the-loop in Scriptum automation processes?
This is implemented by configuring the BPMN model: the AI agent performs only isolated service tasks, such as preparing or initially analyzing a document, after which the process moves to a user task where a human performs the final check and applies a digital signature.