AI-Schritte in Abläufe integrieren

AI & Tool Step Integration

Use this skill when embedding LLM prompts, structured extraction, classification, or autonomous tool-using AI agent steps inside deterministic workflows.

Never Trust Unverified AI Text as Proof of Side Effects

1. Validate Structured Outputs Against a Strict Schema:
   • When an AI step drives downstream workflow branching or data mapping (e.g., routing a support ticket, extracting invoice fields, choosing a category), enforce a strict JSON Schema / structured output contract (response_format / tool schema).
   • If the model output fails schema validation, refuses, or returns low confidence below a configured threshold, route to an explicit fallback / human_review / error port rather than passing malformed data to downstream steps.
2. Never Treat an LLM's Natural-Language Claim as Proof of Execution:
   • An AI step saying "I have refunded the customer and sent the confirmation email" is not proof that those actions occurred.
   • Verify actual tool call receipts / deterministic step execution records, or keep external state-mutating actions as explicit, auditable workflow steps outside the free-form prompt.

Durable Checkpointing & Cost/Token Bounds

• Checkpoint Completed AI & Tool Steps:
  • Persist the resolved LLM output, token usage, model identifier, and tool call results at the step boundary so if a downstream step fails and retries, the workflow replays the recorded AI step output instead of re-billing and re-running the LLM non-deterministically.
• Enforce Explicit Execution Budgets:
  • Configure hard limits on every AI step: maxTokens, maxToolCalls / maxIterations, timeoutMs, and allowed tool allowlists so an agent loop inside a workflow can never spin indefinitely.

Tenant Isolation, Permissions & Prompt-Injection Defense

• Scoped Authority (effective_permissions = run_actor ∩ workflow_scope ∩ step_tool_allowlist):
  • AI steps and tool calls must execute strictly within the active tenantId and the initiating principal's authorized scope.
  • Gate high-impact or irreversible actions (payments, deletions, external broadcasts, permission changes) behind a deterministic workflow Approval step before the tool executes.
  • Delimit untrusted external input (emails, webhooks, uploaded documents) clearly and never allow untrusted prompt content to override workflow control-flow rules or tool target tenant IDs.

Checklist

• Are AI step outputs validated against a strict schema before driving downstream workflow branches?
• Are external side effects verified via deterministic tool/step execution receipts rather than LLM prose claims?
• Are completed AI step outputs checkpointed so downstream retries do not re-invoke the LLM unnecessarily?
• Are tool allowlists, token/iteration budgets, tenant isolation, and human approval gates enforced on AI steps?