Scopebound Scope Check icon

Scopebound Scope Check

Pre-execution scope enforcement: validates workflows against an agent role authorization scope before they run

Scopebound Scope Check

AI-generated

Summary

Evaluates a workflow definition against one or more Scopebound profiles for a selected agent role. Adds the evaluation result to each output item as _scopebound, then passes, blocks, or throws on items with critical violations according to the selected mode.

Inputs

  • Role (required) — Choose a Scopebound role by UUID or human-readable name; the corresponding Role ID or Role Name field is required.
  • Evaluation Profile (required) — Select one or more profiles: SOC1, SOC2 Type II, Production Readiness, or HIPAA. Defaults to Production Readiness.
  • Workflow Source — Read a workflow from each input item, or provide one JSON workflow in the node parameter. For input items, Workflow Field optionally names the JSON field; if blank, the entire item JSON is evaluated. Parameter mode evaluates the supplied workflow once and attaches the same result to each input item.
  • Workflow JSON (required) — Workflow definition used when Workflow Source is From Node Parameter.
  • Workflow Format — Declare the workflow format: canonical, n8n, Make, or Zapier. Defaults to canonical; n8n translation is marked preview-only.
  • Mode — Choose Warn Only (default), Block on Critical Violations, or Throw on Critical Violations.

Output shape

Two outputs: Pass and Fail. Each emitted item retains its input JSON with the evaluation result added under _scopebound.

Warn Only routes all items to Pass. Block on Critical Violations routes only items with critical violations to Fail; non-critical violations pass. Throw on Critical Violations halts with an operation error when a critical violation occurs. In input-item mode, each non-empty item is evaluated separately; in parameter mode, one result is attached to every input item. API/request errors and missing or empty workflow inputs also raise errors.

Links

Discussion