Implementing artificial intelligence in enterprise BPM systems requires a radical shift from using public APIs to a "secure perimeter" architecture. Without this, document automation becomes a source of constant security threats. Today, as up to 49% of interactions with enterprise AI assistants involve cognitive tasks—document analysis, decision-making, and expert evaluation—the risk of uncontrolled data leakage becomes critical for CTOs and CISOs. Standard perimeter defense methods are no longer capable of containing threats that emerge from within the models themselves.
Anatomy of the threat: why public APIs and uncontrolled AI agents are a time bomb for BPM
When we integrate large language models (LLMs) into corporate content processing, we are not just providing them with raw text, but with sensitive metadata, trade secrets, and personal customer data. Using public cloud APIs for these tasks creates a direct risk of information leakage. According to the OWASP Top 10 Risk & Mitigations for LLMs and Gen AI Apps 2025 classification, the LLM02 threat (Sensitive Information Disclosure) is one of the most critical in document automation. Sending data to external servers for inference often means losing control over how that data will be used, particularly for further model training.
The second fundamental threat is the uncontrolled behavior of AI agents themselves. Since agents gain the ability to call external tools (tool calling) and make decisions regarding document routing, the risk of LLM01 (Prompt Injection) vulnerabilities arises. An attacker can inject malicious instructions directly into the body of a processed document (e.g., a PDF invoice), which would force the AI agent to perform unauthorized actions in the BPM system: changing payment details, sending a confidential file to an external address, or bypassing mandatory approval stages.
Security foundation: adapting NIST AI RMF 1.0 and OWASP Top 10 for document automation
To systematically mitigate these risks, the security architecture must be based on recognized standards. The NIST AI RMF 1.0 framework structures AI risk management around four key functions:
- Govern: Establishing clear corporate policies regarding which document types and data classes are permitted for transmission to AI components.
- Map: Identifying all touchpoints between the BPM system, vector databases, and LLM instances.
- Measure: Continuous assessment of AI response quality, hallucination levels, and injection attempts using automated tests.
- Manage: Deploying rapid response mechanisms—from blocking suspicious requests to isolating agents.
It is important to understand that using even local LLMs does not guarantee the complete absence of security risks. Although on-premises models eliminate the risk of data leakage to third parties, they remain vulnerable to prompt injection and logic errors. Therefore, security must be built as a multi-layered system.
The "secure perimeter" architectural pattern: local RAG and LLM instance isolation
To ensure confidentiality when working with large document volumes, a reliable approach is the Retrieval-Augmented Generation (RAG) pattern, deployed within the organization's secure perimeter (on-premises or in a private cloud).
The architecture of such a solution consists of three key layers:
- Storage and indexing layer: Documents pass through a local chunking service. Using a local embedding model, fragments are converted into vectors and stored in an isolated vector database.
- Knowledge orchestration layer: The system performs a semantic search in the local vector database, extracts relevant contexts, and forms a prompt for the LLM.
- Generation layer: The prompt is sent to a fully local LLM instance. Data does not leave the corporate network.
An additional security element is a security gateway that automatically masks personal data before sending it to the model, even if it is running locally.
Orchestration against chaos: how BPMN and DMN limit the scope of AI agents
The main mistake when integrating AI is giving the model complete freedom of action. An AI agent should not independently manage a business process; it must be embedded within the strict framework defined by the BPMN 2.0 standard. This is an executable standard that allows a single model to simultaneously document and manage the execution of a business process. Instead of chaotic function calls, the AI agent performs a specific task, and the results of its work are passed along the scheme, which is controlled exclusively by the BPM engine.
DMN tables are used for dynamic control. A real-world example is the use of DMN tables to decide whether a document can be processed by a public API or if it requires an isolated local LLM instance. This allows data to be routed based on its criticality. It should be remembered that BPMN models cannot automatically correct AI hallucinations without additional mechanisms, so additional automated checks and Human-in-the-Loop steps are integrated into the process.
Audit and anomaly detection: using process mining to monitor AI processes
Even with strict BPMN schemes, unpredictable actions by AI agents can create risks. For this, Process Mining is used—a technology that allows for the identification of "shadow" routes and bottlenecks, showing how the process is actually executed rather than how it was designed.
A real-world example of Process Mining application is verifying whether AI agents are creating unauthorized workarounds in document processing that violate corporate security policies. This allows for blocking logical anomalies before they lead to an incident. About 13% of organizations (the "Pacesetters" group) consistently outperform competitors in terms of value from AI implementation, and the use of such deep analytical tools is part of their success.
The low-code platform Scriptum (InBase), based on the high-performance UnityBase platform (jointly developed by the Intecracy Group consortium), is optimally suited for implementing a secure perimeter. Scriptum allows for the design of strict BPMN/DMN scenarios, the integration of local AI models without data leaving the corporate perimeter, and ensures a full audit of AI agent actions.
| Data Class | Recommended Architecture | Orchestration and Control Method |
|---|---|---|
| Public / Low Risk | Hybrid (Public API with data masking) | BPMN process with automatic desensitization before transmission |
| Confidential (Internal Only) | Private cloud / Local RAG | Strict DMN routing rules, isolated vector database |
| Strictly Confidential | Fully local perimeter (On-premises LLM) | Execution exclusively within a secure perimeter without Internet access |
FAQ
How can corporate documents be protected from leakage when using Retrieval-Augmented Generation (RAG)?
Protection is achieved by deploying all RAG components (chunking services, embedding models, vector database, and LLM instance) within an isolated corporate perimeter (on-premises or private cloud) using a "secure perimeter" architecture.
Which OWASP Top 10 threats for LLMs are most critical for document automation in BPM?
The most critical are LLM02 (Sensitive Information Disclosure)—the risk of exposing confidential information via API, and LLM01 (Prompt Injection)—where malicious instructions in documents force an AI agent to perform unauthorized actions in the system.
How can BPMN 2.0 and DMN be used to control the behavior and authority of AI agents?
BPMN 2.0 acts as a strict executable framework where the AI does not manage the process but performs isolated tasks. DMN tables are used for decision-making, such as routing documents to public or local LLMs depending on their confidentiality level.