n8n 與 AI 工作流正式環境就緒矩陣列出 32 項檢查

A workflow is not production-ready because the happy path ran once. This matrix lists thirty-two checks for n8n workflows and AI agents. Each one asks for evidence you can inspect and a failure test you can actually trigger before deployment, so it stays useful when tools, model providers and infrastructure change.

Rows marked all apply broadly, rows marked n8n refer to platform-level review, and rows marked ai cover non-deterministic output, tool use and agent authority.

Ownership and scope

OWN-01 Named workflow owner (critical, scope all). Evidence: Owner, deputy and business approver are recorded. Failure test: No one has authority to decide during failure.
OWN-02 Observable success condition (high, scope all). Evidence: A measurable output, acceptance rule and review window are written down. Failure test: A successful execution is mistaken for a useful outcome.
OWN-03 Stop conditions (critical, scope all). Evidence: The workflow defines inputs and states that must block automation. Failure test: Automation continues through ambiguity or unsafe context.
OWN-04 Dependency inventory (high, scope all). Evidence: APIs, models, credentials, queues, databases and human steps are listed. Failure test: A hidden dependency fails without an owner or fallback.

Inputs and data

IN-01 Authenticated trigger (critical, scope all). Evidence: Public triggers use appropriate authentication or a documented public-access decision. Failure test: An unauthorized caller starts a sensitive workflow.
IN-02 Schema validation (critical, scope all). Evidence: Required fields, types, sizes and allowed values are checked before processing. Failure test: Malformed input causes unsafe branching or downstream errors.
IN-03 Untrusted-content boundary (critical, scope ai). Evidence: External text and files are treated as data, not instructions. Failure test: Injected content changes tool or model behavior.
IN-04 Data minimization (high, scope all). Evidence: Only fields necessary for the workflow are collected and retained. Failure test: Sensitive data is exposed without operational need.
IN-05 Authoritative source rule (high, scope all). Evidence: Conflicts between systems resolve to a named source of truth. Failure test: Different runs produce inconsistent decisions from conflicting data.

Execution and recovery

FLOW-01 Idempotency key (critical, scope all). Evidence: Repeated triggers and retries cannot duplicate the external effect. Failure test: A timeout or replay creates duplicate records or messages.
FLOW-02 Bounded retry policy (critical, scope all). Evidence: Only transient failures retry, with a cap, delay and terminal path. Failure test: A persistent failure loops, increases cost or repeats side effects.
FLOW-03 Explicit timeout (high, scope all). Evidence: Every remote dependency has a timeout shorter than the workflow budget. Failure test: One call holds the workflow indefinitely.
FLOW-04 Error workflow (critical, scope n8n). Evidence: Unhandled failures reach a tested error path with useful context. Failure test: The execution stops silently or alerts without diagnostic data.
FLOW-05 Partial-failure policy (critical, scope all). Evidence: The design states when to stop, compensate, queue or continue. Failure test: Continue-on-error hides a missing critical step.
FLOW-06 Dead-letter path (high, scope all). Evidence: Terminal failures are retained for bounded, authorized replay. Failure test: Failed work is lost or retried blindly.
FLOW-07 Manual recovery runbook (high, scope all). Evidence: A person can identify state, avoid duplicates and resume safely. Failure test: Recovery requires ad hoc database or workflow edits.

AI behavior

AI-01 Representative evaluation set (critical, scope ai). Evidence: Typical, edge, ambiguous and refusal cases are versioned. Failure test: A prompt change ships without behavioral comparison.
AI-02 Structured output validation (critical, scope ai). Evidence: Model output is parsed against a strict schema before use. Failure test: Malformed or invented fields reach downstream actions.
AI-03 Least-capability tools (critical, scope ai). Evidence: The agent receives only the tools and parameters required for its task. Failure test: A manipulated or mistaken choice has excessive impact.
AI-04 Human approval for material actions (critical, scope ai). Evidence: External, financial, sensitive or irreversible actions require proportionate approval. Failure test: A plausible but wrong output directly changes external state.
AI-05 Model and prompt version (high, scope ai). Evidence: Model, parameters, prompt and tool manifest are identifiable per execution. Failure test: A behavioral regression cannot be attributed or reproduced.
AI-06 Cost and loop ceiling (critical, scope ai). Evidence: Token, step, time and tool-call ceilings stop runaway execution. Failure test: An agent loop consumes unbounded budget or API capacity.

Security and privacy

SEC-01 Least-privilege credentials (critical, scope all). Evidence: Each credential exposes only necessary operations and environments. Failure test: A node compromise grants broad account access.
SEC-02 Secret hygiene (critical, scope all). Evidence: Secrets stay in credential storage or controlled environment configuration. Failure test: Keys leak into workflow JSON, logs or error messages.
SEC-03 Risky-node review (high, scope n8n). Evidence: Code, shell, file, database and community nodes receive explicit review. Failure test: A powerful node expands the attack surface unnoticed.
SEC-04 Log redaction (critical, scope all). Evidence: Tokens, personal data and confidential payloads are removed or minimized in traces. Failure test: Debug evidence becomes a data leak.
SEC-05 Retention and deletion rule (high, scope all). Evidence: Execution data has a documented retention period and deletion process. Failure test: Sensitive payloads remain indefinitely.

Operations

OPS-01 Deployment version and rollback (critical, scope all). Evidence: A release is identifiable and a prior safe version can be restored. Failure test: An incident cannot be contained without rebuilding from memory.
OPS-02 Health versus outcome metrics (high, scope all). Evidence: Availability, error rate, latency, cost and output quality are measured separately. Failure test: HTTP success hides wrong or low-quality output.
OPS-03 Actionable alerts (high, scope all). Evidence: Alerts have severity, owner, destination, threshold and response expectation. Failure test: Noise masks a material failure.
OPS-04 Synthetic failure test (critical, scope all). Evidence: Timeout, bad input, rate limit and downstream outage paths are exercised. Failure test: The fallback exists only on the canvas and fails when needed.
OPS-05 Periodic access and audit review (high, scope n8n). Evidence: Credentials, webhooks, nodes, versions and inactive workflows are reviewed. Failure test: Old access and exposed triggers accumulate silently.

Use and limits

The matrix is a review aid, not a security certification, warranty or substitute for a project-specific legal, privacy or compliance assessment. Not every check applies to every workflow.

A green execution status proves that the engine completed a path. It does not prove that the output was correct, authorized or useful.

References

The versioned matrix, with CSV and JSON downloads, is on victorlaybats.com and mirrored in the IVRYN open research repository. If you run n8n or agents in production, I would like to know which check you would add.