Open benchmark · Apache 2.0 · Sibling to GovernanceBench
Workflow-orchestration governance is a measurable category.
WorkflowBench scores n8n, Zapier, Make, Pipedream, Tray, Workato, Power Automate, Apache Airflow, Temporal against six workflow-class threats that agent-shape benchmarks do not cover: trigger-spoofing, cascade-poisoning, audit-bypass via node-reorder, cross-workflow leak, third-party-node supply-chain, workflow-replay tampering.
Agentomy-governed n8n
100 / 100
Trigger-spoofing suite, 5 / 5 PASS, measured 2026-06-20 against live containers
Bare n8n (no governance)
N / A
5 / 5 scenarios skipped -- the platform exposes no adjudication primitive to score against. Architectural absence, not failure.
Why workflow governance is its own category
Workflow runtimes execute DAGs of nodes. The attack surface differs from single-agent governance.
GovernanceBench scores agent-shape governance: tier authorization, hash-linked audit chain, fleet halt, behavioral monitoring, OWASP coverage. Those primitives apply when a single agent makes tool-calls. They do not cover the threat surface of workflow runtimes that execute trigger-driven DAGs of nodes.
WorkflowBench is the sibling: same Apache-2.0 license, same adapter pattern, same evidence-class discipline, focused on workflow-shape. Each of the six threats below maps 1:1 to a primitive a workflow runtime should expose for governance.
Six workflow-class threats
What WorkflowBench measures.
WGB-T-A
Trigger-spoofing
Forged or hijacked webhook / scheduler / email / SaaS event-hook drives unintended workflow execution. Source-attribution + signature verification + adjudication must run before any downstream node.
WGB-T-B
Cascade-poisoning
LLM-call output (untrusted) flows into downstream tool-call input (privileged) without provenance attestation. Each tool-call input must be hash-linked to the upstream node that produced it.
WGB-T-C
Audit-bypass via node-reorder
Workflow author moves audit node so it logs before the privileged operation, or removes it entirely. The runtime must emit its own audit entry the author cannot suppress.
WGB-T-D
Cross-workflow leak
One workflow audit chain contaminates another, or secrets leak across execution contexts. Workflow-scoped audit isolation must hold.
WGB-T-E
Third-party-node supply-chain
Community-published node manifest contains adversarial behavior (data exfiltration, hidden tool-call, encoded payload). Pre-execute manifest verification must block.
WGB-T-F
Workflow-replay tampering
Execution-history replay must produce identical audit chain or detect tamper. Hash-linked attestation chain across the entire execution.
Live-adapter cohort · Tier 1
Run it. Compare it. Verify it.
Numeric scores publish only for live-adapter measurements reproducible against a runnable target. Documentation-review tier (queued below) is qualitative, no numeric score.
| Platform | Measured score | Suite | Date | Reproduce |
|---|---|---|---|---|
| Agentomy-governed n8n | 100 / 100 | Trigger-spoofing 5 / 5 | 2026-06-20 | workflowbench run --adapter agentomy --target http://localhost:3000 |
| n8n (bare, v1.x) | N / A | 5 of 5 scenarios skipped -- primitive absent | 2026-06-20 | workflowbench run --adapter n8n --target http://localhost:5678 |
N / A for bare n8n is not a failure. It is the correct evidence-class shape when a target lacks the primitive being scored. Bare n8n has no inbound trigger adjudication endpoint, so all 5 trigger-spoofing scenarios skip with "Skipped: target lacks ingest-adjudication endpoint." The honest comparison: bare cannot be scored on this primitive; Agentomy-governed scores 100 / 100 on the same primitive.
Tier 2 · Documentation review queue
Workflow runtimes pending live-adapter elevation.
Platforms with no public-runnable governance API qualify for documentation-review tier. No numeric scores; queued for live-adapter elevation when reproducible access becomes available.
| Platform | Vendor stance | Status |
|---|---|---|
| Zapier | Closed source; cloud-hosted; no public governance API | Doc-review queued |
| Make (Integromat) | Closed source; cloud-hosted; no public governance API | Doc-review queued |
| Pipedream | Hybrid OSS; per-account governance not exposed | Doc-review queued |
| Tray.io | Closed source; enterprise SaaS | Doc-review queued |
| Workato | Closed source; enterprise SaaS; governance API not public | Doc-review queued |
| Microsoft Power Automate | Closed source; Azure-hosted; governance via Purview / Entra (not WorkflowBench-compatible) | Doc-review queued |
| Apache Airflow | OSS; self-host runnable; live-adapter pending | Live-adapter pending |
| Temporal | OSS; self-host runnable; live-adapter pending | Live-adapter pending |
Reproducibility
Same commits + same containers produce the same numbers.
Both Agentomy + WorkflowBench are Apache-2.0. Clone, spin up the target, run the benchmark. No sales engagement required.
# Spin up bare n8n docker compose -f n8n-measurement/docker-compose.yml up -d until curl -sk http://localhost:5678/healthz | grep -q ok; do sleep 3; done # Spin up Agentomy governance server (governed routing destination) docker compose up -d agentomy until curl -sk http://localhost:3000/health | grep -q healthy; do sleep 3; done # Bare n8n node cli/workflowbench/bin/workflowbench.mjs run --adapter n8n --target http://localhost:5678 --suite trigger-spoofing # Agentomy-governed node cli/workflowbench/bin/workflowbench.mjs run --adapter agentomy --target http://localhost:3000 --suite trigger-spoofing
Tier mapping · Each capability is tier-gated
Free OSS nodes + tier-gated server capabilities.
The @agentomy/n8n-nodes npm package is Apache-2.0 OSS -- install it free. Each node routes through a tier-gated Agentomy governance server capability. Free Evaluator tier unlocks verification + WorkflowBench runs. Higher tiers unlock per-capability access. Pick the lowest tier that covers your workflow needs; upgrade when the next capability is required.
| Node | Server capability | Min tier |
|---|---|---|
| Agentomy: Authorize | enforcement.evaluate (full enforcement chain) | Analyst |
| Agentomy: Audit Action | audit.read.own (free) + siem.format (Builder) | Evaluator+ |
| Agentomy: IPI Guard | ipi.adjudicate (NEW Phase 2) | Analyst |
| Agentomy: Policy Check | enforcement.evaluate | Analyst |
| Agentomy: Halt Trigger | Listens to halt.agent.single events | Operator |
| Agentomy: Workflow Attestation | attestation.workflow (NEW Phase 2) + provenance.record | Builder |
| Agentomy: Skill Bind | skill.registry.read + skill.verify | Analyst |
| Agentomy: Skill Verify | skill.verify (SkillSpector pre-execute scan) | Analyst |
| Agentomy: Workflow Isolate | audit.isolation.workflow (NEW Phase 2) | Builder |
| WorkflowBench CLI | benchmark.workflow (NEW Phase 2; mirrors benchmark.governance) | Evaluator (free) |
The TierFeatureMatrix is the same source that powers the SDK, the dashboard, and the CLI. Queryable at GET /api/tiers. Every denial response from the API includes the exact upgrade path. See tiers.html for the full 5-tier matrix.
Workflow governance is measurable. The benchmark is open.
WorkflowBench publishes the first measurable governance scoring for workflow-orchestration platforms. Apache-2.0. No sales engagement.
View on GitHub