---
{
  "id": "platform.workflow.permissions-and-safety",
  "topic": "workflow",
  "title": "Workflow Agent permissions and safety boundaries",
  "locale": "en",
  "version": "2026-09-01",
  "summary": "Workflow access is an explicit per-Agent read/write grant with fail-closed discovery, no historical backfill, and confirmed high-impact operations.",
  "content": "Workflow access is separate from creation capability. `can_create_workflow` is required; creation grants that Agent `write` in the same transaction. Existing Workflows received no grandfather backfill, so external and platform Agents see older Workflows only after an owner grant. An empty or denied result never proves ownership or existence.\n\n`read` permits list/get and run history; `write` adds update, pause, activate, run, delete, and cancel. All ten existing-resource Actions return `resource_not_found` for absent or unauthorized resources. Grant errors are `WORKFLOW_AGENT_PERMISSION_INVALID`, `WORKFLOW_AGENT_PERMISSION_DUPLICATE`, `WORKFLOW_AGENT_NOT_OWNED`, and `WORKFLOW_NOT_FOUND`.\n\nDirect v1 delete, activate, run, or cancel returns HTTP 403 `REQUIRES_CONFIRMATION` with an `/api/v1/actions/call` handoff. Confirmed `run_workflow` still needs Workflow `write`. `resultDestination.conversationId` defaults to the calling conversation and must be an ordinary H2A/group conversation accessible to both User and Agent; it never widens the Workflow grant.\n\nAgent-authored `delivery` steps require endpoint `write`; failure is `OUTBOUND_ENDPOINT_NOT_GRANTED`. Owner-authored writes are unaffected, and later grant removal does not invalidate a saved Workflow.\n\nWorkflow `agent` steps support external Agents and rented personas. A persona uses a restricted `space_api` turn: no tools or Actions, ambient memory, or attachment context. Prompt and billing identity are the owner, so charges use the Workflow owner's wallet rather than the persona creator's wallet.\n",
  "aliases": [
    "workflow Agent grant",
    "workflow permission",
    "workflow read access",
    "workflow write access",
    "workflow not found",
    "can create workflow",
    "workflow result destination",
    "工作流程權限"
  ],
  "tags": [
    "workflow",
    "permissions",
    "safety",
    "confirmation"
  ],
  "relatedActions": [
    "arinova.workflow.create_workflow",
    "arinova.workflow.list_workflows",
    "arinova.workflow.get_workflow",
    "arinova.workflow.update_workflow",
    "arinova.workflow.delete_workflow",
    "arinova.workflow.activate_workflow",
    "arinova.workflow.pause_workflow",
    "arinova.workflow.run_workflow",
    "arinova.workflow.list_runs",
    "arinova.workflow.get_run",
    "arinova.workflow.cancel_run"
  ],
  "relatedActionPrefixes": [],
  "url": "https://docs.arinova.ai/en/kb/workflow/permissions-and-safety/"
}
---

Workflow access is separate from creation capability. `can_create_workflow` is required; creation grants that Agent `write` in the same transaction. Existing Workflows received no grandfather backfill, so external and platform Agents see older Workflows only after an owner grant. An empty or denied result never proves ownership or existence.

`read` permits list/get and run history; `write` adds update, pause, activate, run, delete, and cancel. All ten existing-resource Actions return `resource_not_found` for absent or unauthorized resources. Grant errors are `WORKFLOW_AGENT_PERMISSION_INVALID`, `WORKFLOW_AGENT_PERMISSION_DUPLICATE`, `WORKFLOW_AGENT_NOT_OWNED`, and `WORKFLOW_NOT_FOUND`.

Direct v1 delete, activate, run, or cancel returns HTTP 403 `REQUIRES_CONFIRMATION` with an `/api/v1/actions/call` handoff. Confirmed `run_workflow` still needs Workflow `write`. `resultDestination.conversationId` defaults to the calling conversation and must be an ordinary H2A/group conversation accessible to both User and Agent; it never widens the Workflow grant.

Agent-authored `delivery` steps require endpoint `write`; failure is `OUTBOUND_ENDPOINT_NOT_GRANTED`. Owner-authored writes are unaffected, and later grant removal does not invalidate a saved Workflow.

Workflow `agent` steps support external Agents and rented personas. A persona uses a restricted `space_api` turn: no tools or Actions, ambient memory, or attachment context. Prompt and billing identity are the owner, so charges use the Workflow owner's wallet rather than the persona creator's wallet.