n8n AI Workflow Safety and Operations
n8n AI Workflow Safety and Operations
Key jargon
| Term | Plain-language meaning |
|---|---|
| Credential scope | The exact resources and operations an automation credential can access. |
| Expression | A runtime value or transformation evaluated within an n8n node. |
| Execution record | Stored state and output from a workflow run. |
| Error workflow | A separate workflow invoked to handle or report failures. |
Key concepts
- Treat imported workflows and community nodes as supply-chain inputs requiring review.
- Restrict credentials per node purpose, validate expressions and inputs, configure error paths, and control stored execution data.
Concept map
flowchart LR
A["Review workflow and nodes"] --> B["Bind least-privileged credentials"]
B --> C["Execute with validation and error path"]
C --> D["Inspect records and rotate secrets"]Checklist
- Authenticate webhooks and prevent replay.
- Store credentials in the supported credential store, not workflow JSON.
- Restrict expression/code nodes and community packages.
- Pin workflow versions and export reviewed backups without secrets.
- Redact execution data and set retention.
- Add retry limits, idempotency keys, timeout, and error workflow.
- Separate read/propose from send/update/delete.
- Require human approval for consequential effects.
- Restrict network egress and destination allowlists where possible.
- Test with synthetic credentials and data.
Exercise
Import a harmless three-node workflow in an isolated instance. Trigger twice with the same event ID and demonstrate duplicate suppression and an error path.