Data Visibility and Redaction

WOML limits operational data, but workflow authors still decide what business data scripts return or transmit.

Excluded from inspection

Safe run inspection omits trigger payloads, complete context, step result values, credentials, secret values, operation keys, idempotency keys, provider bodies, and stack traces.

Managed operation events contain bounded metadata rather than HTTP bodies, SQL parameters, object bodies, state values, or cache values. Loop inspection contains indexes and counts, never item values.

Author responsibility

A script can intentionally return a password or send personal data to an API. WOML cannot infer business sensitivity. Return only necessary values, avoid logging sensitive payloads, and keep secrets out of notification templates and URLs.

Understand three data surfaces

Business context contains the trigger payload and returned step data needed by later work. Durable event history stores bounded execution facts and committed outputs required for recovery. Operational views expose redacted status, identity, counts, durations, and safe failure metadata.

These surfaces are intentionally different. An operator can see which step failed without automatically receiving the customer's complete payload or the HTTP request body.

Design minimal step results

Instead of returning an entire customer record, return the ID and fields required downstream. Store larger artifacts through services.storage and keep database records in the database.

Do not rely on redaction to fix a script that explicitly logs secrets.API_TOKEN or returns credentials. WOML protects known runtime fields but cannot infer every business-sensitive string.

Review notification and URL exposure

Notification providers leave the local runtime and may display content to many people. URLs may enter proxies, server logs, or analytics systems. Keep tokens, personal data, and approval capabilities only in their intended protected transport fields.

Apply organizational retention and access policy to the state database, object store, logs, and backups.