Minbook
KO
The Risk Audit, as a Process
Build Logs & SaaS Planned 4 posts

The Risk Audit, as a Process

Pre-deployment risk review for AI workflows lives inside consulting engagements: one to two senior-weeks per workflow, non-standard, not re-runnable. This is the record of moving that review into a 36-cell ontology and a single governed BPMN run. Built as the UiPath AgentHack 2026 Maestro BPMN third-prize project.

About this series

Most enterprises learn where an AI workflow breaks only after it ships. Node-level risk review before deployment does exist, but today it exists as a consulting engagement: one to two senior-weeks per workflow, a deliverable that goes stale, and no way to re-run it when the workflow changes.

This series is the record of moving that review into a re-runnable process. It walks through a 36-cell ontology scoring 12 nodes on 3 risk axes, why the auto-approval node scores highest, and how a BPMN process engine can act as the governance spine rather than a wrapper.

Every source used here is public: the ontology, architecture, run screenshots, and the leads that failed verification, from the project submitted to UiPath AgentHack 2026 that took third prize in the Maestro BPMN track.

4 episodes

  1. 01
    Anchor post

    You Find Out Where It Breaks After You Ship - Moving the Pre-Deployment Check into a Process

    Pre-deployment risk review for AI workflows lives inside consulting engagements: one to two senior-weeks per workflow, not re-runnable. Why this quadrant stayed empty, when the regulatory deadlines actually land, and what remains once the check becomes a single governed run.

  2. 02

    The Axis No Public Dataset Had Got the Largest Weight - A 36-Cell Risk Ontology

    Scoring an AI workflow node by node needs a scoring table first. The general-failure and security axes came from OWASP, MITRE ATLAS, and MIT material, but the third axis, the one that looks between nodes, existed in no public framework. Why it got 0.4, and why only its score can rise mid-run.

  3. 03

    The Riskiest Node Was Auto-Approval - Catching Silent Over-Trust with a Subtraction

    Two workflows from different domains, scored on the same table, put their top scores on nodes of the same character: the ones where the human lets go. One subtraction that catches silent over-trust, the arithmetic that pushes a 3.6 node to 4.9, and why being red is not the same as reaching a human.

  4. 04

    The Gate Condition Is Written on the Diagram - Using BPMN as a Governance Spine

    Putting the human gate inside a code conditional and putting it inside a process definition are different things. What changes when a coded agent sits as one node inside an 18-object BPMN process and the gate condition is spelled out on the diagram, plus the three problems that actually blocked the run.