No/Low-Code Security Plane

The No/Low-Code Security Plane (NLC) secures visual agent workflows on platforms that cannot embed the Pavri SDK in-process. It treats each workflow or bot as a first-class agent — same inventory, same policy engine, same telemetry, same dashboard as coded agents.

Why NLC

No-code and low-code automation platforms (Power Automate, Make, Zapier, n8n, etc.) are the fastest-growing surface area of AI-driven actions in the enterprise. Unlike coded agents, they cannot embed an in-process SDK, but they can be secured through integration primitives every major platform exposes: connector modules, HTTP steps, webhook fulfillment, run-history APIs, and audit logs.

Pavri leverages these primitives across four integration patterns.

The Four Integration Patterns

1. Policy Step Connector

A drag-and-drop step you add to your workflow that calls Pavri's Policy Evaluation API before a high-risk action executes.

Endpoints:

• POST /v1/eval — evaluate policy for an action
• POST /v1/register — register the workflow as a tracked agent
• POST /v1/redact — redact PII before it leaves the platform

See the Policy Eval API reference.

2. Outbound Proxy

Route the workflow's HTTP/API calls through Pavri's outbound proxy. The proxy enforces egress policy, mediates credentials from a vault (injecting secrets so they never live on the platform), strips sensitive caller-supplied headers, and emits a ToolCallEvent for every upstream request.

The proxy is the strongest enforcement point because it owns the tool-call boundary.

3. Telemetry Ingestion

Pavri ingests platform-native run histories and audit logs (Make scenario logs, Zapier task history, Power Platform Purview, GCP Cloud Logging, Workato audit logs, n8n log streaming, etc.) and normalizes them into the same EventEnvelope schema used by coded agents.

This delivers inventory, compliance evidence, and detections even on platforms where inline enforcement is not available.

4. Design-Time Governance

Pavri discovers workflows via platform APIs, classifies their connectors by risk, detects drift against a certified baseline, and supports automated workflow certification.

See Workflow Certification.

How Workflows Appear in the Dashboard

A registered no-code workflow looks like any other agent in the inventory:

• Platform column shows the platform badge (Make, Zapier, Power Automate, etc.)
• Source filter separates SDK agents from no-code workflows when needed
• Agent detail drawer shows workflow ID, trigger type, and connector risk summary
• Same policy engine, same risk scoring, same session timelines

You can filter, sort, certify, and route alerts the same way you would for a LangGraph or CrewAI agent.

Enforcement Strength

Pattern	Enforcement	Coverage
Policy Step Connector	Strong (for gated steps)	High adoption required
Outbound Proxy	Strongest (for routed calls)	Platform support required
Telemetry Ingestion	Observe-only	Universal (log-based)
Design-Time Governance	Preventative	Platform API access required

Pick the right pattern per workflow. Most customers use a mix: observe-only telemetry on the long tail, proxy + policy step on high-risk flows.

Credential Mediation

The outbound proxy can inject credentials from a HashiCorp Vault KV v2 store into outgoing requests. This means:

• Platform users never see or hold the upstream API keys
• Credentials are rotated centrally in Vault
• Every credential use is audited

Configure credential policies per tenant + upstream domain pattern. See the credential mediation section of the integration guide.

Approval Gates

High-risk workflow actions (financial transactions, privileged API calls) can be gated behind human approval. When a workflow triggers an action that matches an approval policy:

1. Proxy returns 202 Accepted with an approval request ID
2. An approval channel (Slack, email, webhook) notifies the approver group
3. On approve → proxy forwards the request
4. On deny or timeout → proxy returns the denial

Fleet Intelligence

With both coded and no-code agents in one inventory, Pavri provides:

• Unified fleet posture
• Cross-platform anomaly correlation (same actor behaving suspiciously across Make + Zapier)
• Shadow automation discovery (workflows calling workflows across platforms)
• Fleet-wide compliance reporting covering all agent types

What Does NOT Change

The NLC Security Plane extends — not replaces — the Pavri architecture. No parallel systems:

• Same AgentRecord type
• Same policy DSL, policy sync, and policy cache
• Same EventEnvelope schema (with 2 new payload variants: WorkflowRunEvent, ControlPlaneChangeEvent)
• Same detection cascade
• Same alert routing, SIEM integration, and response playbooks

If you know how to govern a coded agent in Pavri, you already know how to govern a no-code workflow.