Evaluating Risk and Auditability in Workflow Agents for Safety-Critical Domains

Workflow agents that read messages, retrieve documents, and take follow-up actions can improve productivity, but they also widen the security boundary by combining untrusted content with permissions to access and modify external resources. This issue is especially important in safety-critical domains such as healthcare, where inappropriate access to patient-related information, wrong-recipient disclosure of reports, or deletion of clinically important workflow messages can have serious consequences. We present a controlled framework for evaluating risk and auditability in workflow agents under varying permission scopes and policy settings. Our main testbed is a fully offline, deterministic, and reproducible simulator that isolates how broader permissions amplify harm under permissive settings and how strict policy gating shifts blocking from scope restriction to semantic enforcement. To provide a limited external validity check, we also add a lightweight real-agent validation layer using a local tool-using language model over sandbox workflow cases built from curated real radiology reports from MIMIC-IV-Note. Across both layers, permissive broad access enables harmful forwarding or deletion behaviors, while stricter controls reduce realized harm through policy-based or permission-based blocking. We further implement a practical tamper-evident audit mechanism based on a hash-chained append-only log and show that post-hoc modifications of execution history are detectable and localizable to the first failing block. Together, these results support a layered view of workflow-agent safety in which least privilege, semantic policy gating, and verifiable execution records play complementary roles.