Authority
Who can approve, whether approval is specific, and whether the governed actor can approve itself.
Local educational tool
Can the workflow act without the right authority?
Answer eight questions to identify possible execution-boundary weaknesses. The self-test runs entirely in this browser and does not submit your answers.
What it examines
Six points where control can fail before execution.
Payload
Whether the exact approved action can change silently before execution.
State
Whether required facts and conditions are rechecked when the action occurs.
Replay
Whether old approvals or payloads can be reused outside their intended window.
Bypass
Whether another path can route around the intended decision boundary.
Evidence
Whether the system can prove approval, action, and result without reconstructing the story.
AI workflow boundary self-test
Eight questions. One informational signal.
The result is a prompt for investigation, not authorization to execute.
0 of 8 answered
Boundary: This tool does not inspect source code, credentials, infrastructure, policies, or real enforcement paths. It is not legal advice, security validation, compliance certification, technical proof, or execution approval.
Interpretation
A color is not proof.
Lower observed risk
Fewer obvious issues were selected. Technical verification is still required.
Needs hardening
One or more boundaries appear incomplete or insufficiently verified.
Execution risk
A meaningful authority, payload, replay, bypass, or evidence risk is present.
Boundary failure
The reviewed workflow should not execute until the unresolved boundary is redesigned.
Common questions
Use the result to ask for evidence.
Does a Green result mean the workflow is safe?
No. Green means fewer obvious risks were selected in this limited questionnaire. It does not verify implementation or authorize execution.
Are answers sent to Nemo Flow Systems?
No. The self-test runs locally in your browser. There is no submission endpoint in this site package.
Can this replace a security or compliance review?
No. It is an educational boundary-screening tool, not a security audit, legal review, compliance certification, or technical assessment.
What should happen after a Red or Black result?
Stop execution planning for the affected workflow, identify the exact risk driver, and require technical evidence before reconsidering the action.