As AI agents transition from experimental chatbots to autonomous business process executors, CISO teams are forced to shift their approach. Instead of blocking innovation entirely, Chief Digital Transformation Officers (CDTOs) and security leaders are implementing strict architectural constraints. The primary goal is to mitigate the risk of Excessive Agency, which was included in the updated OWASP Top 10 Risk & Mitigations for LLMs and Gen AI Apps 2025. Automation security is achieved not by improving generative instructions (prompts), but by isolating agent actions within defined process models and strictly enforcing access control.
Anatomy of the Excessive Agency risk: why autonomous AI agents challenge CISOs
Security leaders fear that granting AI agents broad system permissions will allow them to bypass traditional controls. The risk of Excessive Agency arises when developers provide AI with direct API access without intermediate verification layers, relying on the assumption that the Large Language Model (LLM) will independently make logical decisions within safe boundaries. This can lead to unauthorized data access or the accidental execution of critical business operations.
The absence of architectural barriers creates conditions for typical security incidents, including:
- An AI agent independently approving and executing a payment in an ERP system that exceeds authorization limits due to a lack of rigid decision-making rules.
- An agent creating a "shadow" contract approval route, bypassing standard compliance procedures in an attempt to complete a task faster.
- Sensitive Information Disclosure resulting from an agent gaining access to a database with administrative rights instead of a restricted read-only API.
Architectural barriers: how BPMN 2.0 and DMN limit the blast radius
The best way to secure infrastructure is to treat an AI agent not as an autonomous entity, but as an isolated executor of a specific task. Instead of allowing the algorithm to dynamically determine the sequence of API calls, the process logic should be strictly defined using the BPMN 2.0 standard.
According to the Camunda methodology, BPMN 2.0 acts as an executable orchestration standard that provides significant visibility into the state of each process instance. In such an architecture, the next step is always determined by the process schema, not by a generated AI conclusion.
To limit decision-making logic, the DMN (Decision Model and Notation) standard is used. As defined by the Object Management Group, DMN allows business rules to be moved from code into structured decision tables. For example, if an AI agent calculates a discount or approves a transaction, the orchestration system passes this action through a DMN table. If the amount exceeds the limit, the process is forcibly halted and sent for human verification.
The principle of least privilege: isolating AI agents at the platform level
Secure AI integration requires a robust platform that supports strict access control at the metadata level. An example of such an environment is the Scriptum BPM platform, built on the low-code UnityBase platform. UnityBase is a joint development by companies within the Intecracy Group alliance—an association of independent companies linked by partner agreements and share exchanges—which provides fundamental security mechanisms for isolating AI agents.
Limiting autonomy at the platform level is implemented through the following tools:
- Role-Based Access Control (RBAC): An AI agent is granted the status of a standard service user with a minimal set of permissions and no direct database access.
- Row-Level Security (RLS): Even with access to a specific registry, the agent only sees the records and documents necessary to perform its current task.
- Audit Trail: All LLM requests and API calls are recorded in the platform's system log, which the algorithm cannot modify.
In addition to technical limitations, compliance in cognitive component development is essential. The expertise of Softengi allows for the design of such solutions in strict accordance with the ISO/IEC 27001 standard and ISO 42001 (AI management systems), which regulates the security of AI agents within an organization.
Human-in-the-loop: where human responsibility begins
The human-in-the-loop concept remains a mandatory safeguard. AI autonomy ends where legal, reputational, or financial risks arise. Process orchestration platforms halt the execution chain before high-risk transactions. Approving a document with a digital signature or authorizing a large payment physically requires action from a real employee, leaving the AI to handle only routine data preparation.
Audit and process mining: detecting anomalies via event logs
AI behavior requires monitoring even when architectural barriers are in place. To audit the actions of autonomous systems, the process mining methodology is used, based on the analysis of event logs. Process mining tools allow for the reconstruction of actual process flows and comparison with the reference BPMN model.
Log analysis helps identify "shadow" routes or anomalies where an agent attempts to bypass established control procedures. Thanks to detailed event logs generated by the orchestration system, CISOs gain a transparent view of every transaction and the ability to react instantly to signs of Excessive Agency risk.
| Security criterion | Uncontrolled AI agent (Direct API) | Limited agent (BPMN/DMN + Orchestration platform) |
|---|---|---|
| Authority boundaries | Determined dynamically by the LLM (high risk of deviation) | Strictly limited by the BPMN process schema and RBAC permissions |
| Financial decision-making | Autonomous, based on generative instructions | Blocked by DMN tables; limits require human validation |
| Audit trail | Confusing text logs of prompts and responses | Clear event logs in the orchestration system, suitable for process mining |
| Data access level | Direct database access via system account | Limited by Row-Level Security (RLS) at the platform level |
FAQ
How does the ISO 42001 standard help regulate the security of AI agents in an organization?
ISO 42001 introduces an AI management system that regulates model impact assessment, AI decision validation, and the establishment of clear architectural boundaries to prevent Excessive Agency.
Which process mining tools are best suited for auditing AI actions?
For auditing AI agent actions, solutions like Celonis and BPM system modules are used. They analyze system event logs, identifying deviations from agreed-upon reference BPMN models and detecting the use of "shadow" process execution routes.
How to configure secure interaction between an LLM and a corporate BPM system?
Interaction is configured by identifying the AI agent as a separate user with strictly limited permissions (RBAC/RLS). The algorithm does not control the process but acts as an executor of an isolated task (Service Task), while business rules and limits are controlled via DMN decision tables.