As Gartner identifies Agentic AI as a key strategic trend for 2026, enterprises are urgently shifting from chaotic experiments with autonomous bots to orchestration systems that ensure control and auditability. The rapid integration of autonomous agents into real-world business processes has revealed a significant architectural challenge: how to reconcile the non-deterministic nature of large language models (LLMs) with the deterministic requirements of corporate security, regulatory compliance, and auditing.
Organizations face difficulties integrating autonomous AI agents into existing corporate processes without creating vulnerabilities, shadow processes, or data leakage risks. To address this, enterprises must transition from full agent autonomy to a rigid orchestration architecture, where every AI step is constrained by process logic and a domain metadata model.
The autonomy trap: Why chaotic AI bots threaten corporate security
The primary danger of autonomous AI agents lies in their ability to independently determine sequences of actions and interact with other corporate systems. The OWASP Top 10 Risk & Mitigations for LLMs and Gen AI Apps 2025 report identifies "Excessive Agency" and "Sensitive Information Disclosure" as critical threats for such applications.
Without strict constraints, an agent granted broad authority can easily exceed the scope of its task. A typical example is automated document processing, where an AI agent classifies incoming requests but, due to a lack of domain metadata restrictions, gains access to sensitive personally identifiable information (PII) it should not be able to see.
Agents cannot operate in a vacuum. In regulated industries and the B2G sector, the architecture must ensure the auditability of actions initiated by AI agents, which cannot be achieved using isolated scripts.
BPMN 2.0 and DMN as frameworks for AI: Regaining process control
To tame the non-determinism of AI agents, architects use time-tested business process automation standards — BPMN 2.0 and DMN (Decision Model and Notation). These serve as a rigid framework that limits the AI's freedom of action.
According to Camunda, BPMN 2.0 is an executable standard that not only documents but also manages process execution, ensuring visibility into the state of every instance. Instead of allowing an agent to decide what to do next, the orchestrator invokes the AI only to perform a specific task. The process state and transitions between steps remain under the control of the engine.
In turn, the DMN standard allows for the separation of business rules and decision-making logic from the process itself. Consider a procurement process: an autonomous agent analyzes supplier proposals, but financial approval limits are strictly fixed in DMN tables. If an agent attempts to approve a transaction exceeding the set budget limit, the system blocks the action. This eliminates the risk of Excessive Agency without the need to redesign the entire process.
It is important to emphasize that implementing BPMN 2.0 and DMN is not a silver bullet that automatically solves all LLM security issues. They do not replace security tools but rather form an architectural framework that requires a robust foundation at the data level.
Governance as Code: How domain metadata limits excessive agent freedom
To minimize security risks, AI agents must have the same granular access restrictions (RBAC) as regular users. This is effectively implemented through the Governance as Code concept, where security rules are embedded directly into the data model.
The foundation for such orchestration is the low-code platform UnityBase (a joint development of Intecracy Group companies, where InBase is a key developer). The UnityBase architecture is built around a unified domain metadata model that integrates data structure, automatically generated REST API, interface, and security rules.
In such an architecture, an AI agent has no direct access to the database. Any request from an agent passes through the DBMS-agnostic ORM layer of UnityBase, where strict role-based access control (RBAC) and row-level security (RLS) rules are applied. This means the AI is physically incapable of reading data that falls outside the scope of its role.
For integrating agents directly into processes, the low-code platform Scriptum (also part of the Intecracy Group consortium) is used. It integrates the Camunda engine to support BPMN, CMMN, and DMN standards, allowing AI agents to be embedded as isolated Service Tasks.
Audit and process mining: Verifying that AI agents follow the rules
Enterprise-level orchestration requires a transition from executing ad-hoc scripts to fully recording every action taken by an agent. Thanks to built-in audit trail mechanisms and DataHistory tracking in the UnityBase platform, organizations obtain an immutable system log of every operation.
To monitor efficiency and detect hidden deviations, architects use Process Mining technology. According to Celonis, Process Mining provides an evidence-based view of actual process execution compared to the original design. This allows for the identification of situations where an AI bot creates "shadow" workarounds that violate standard corporate compliance procedures.
Architectural pattern for integrating Agentic AI into the corporate landscape
For the secure operation of AI agents, a three-tier architectural scheme is recommended:
- Process orchestration layer (BPMN/DMN): defines business logic, step sequences, and deterministic rules (e.g., platforms like Scriptum).
- Access control and metadata layer (UnityBase): acts as a gateway to corporate data and applies RBAC/RLS rules, blocking unauthorized access.
- Execution layer (AI agents): isolated LLM models that receive a strictly limited context via API, perform tasks, and return the result to the orchestrator.
| Comparison criteria | Autonomous bot (without orchestration) | Orchestrated agent (UnityBase / Scriptum) |
|---|---|---|
| Data access level | Direct DB access via API (OWASP risk: Sensitive Information Disclosure) | Access exclusively through the domain metadata model with strict RBAC at the record level. |
| Decision making | Non-deterministic (decided by LLM based on prompt) | Limited by DMN tables (deterministic business rules and budget limits). |
| Process control | Independently determines next steps (Excessive Agency risk) | Executes a strictly defined task within a BPMN 2.0 process under engine control. |
| Auditability of actions | Logs scattered across services, difficult to reconstruct decision chains | Systematic audit of every transaction and process state change in a unified registry. |
This approach allows for scaling the use of Agentic AI while ensuring compliance with cybersecurity requirements and keeping humans in the loop for critical decision-making.
FAQ
How can I restrict an AI agent's access rights to sensitive data in B2G processes?
Restrictions are best implemented through a domain metadata model (e.g., UnityBase platforms). The agent interacts with the system exclusively via REST API, where strict RBAC and RLS (Row-Level Security) rules are enforced at the ORM layer. This physically prevents access to PII or other sensitive fields.
What is Excessive Agency in the context of LLM application security according to OWASP 2025?
Excessive Agency is a critical security risk where an AI agent is granted overly broad access rights, functions, or autonomy. Without proper constraints, this can lead to unauthorized transactions and failures in business logic.
How can multi-agent systems be integrated into existing enterprise BPMN processes?
Agents are integrated as performers of individual Service Tasks within BPMN 2.0 schemes using process engines (e.g., Scriptum). The agent performs an isolated function, while transitions between process steps and control limits are governed by deterministic process logic and DMN tables.