Workflows

Admin workflow administration is the system-scoped counterpart to tenant Operations → Workflows.

Current model

Product automations ship as published rows in ai_workflow_definitions with owner_scope = system and visibility = automatic. Dispatch includes those graphs for every organization (includeSystem: true). There is no per-organization opt-out settings surface; an organization can archive a copied definition later if that API already allows it.

Safety

Automatic graphs notify or create drafts only:

• Do not send invoices created from accepted quotes.
• Do not auto-reply Inbox threads.
• Do not delete stale drafts or records.
• Do not rematch workflow-failed-alert when that graph itself failed.

Tenant boundary

Organization-specific graphs belong under the tenant operations section. System graphs must not bypass tenant permissions when they mutate records; notify/email steps use admin request context for delivery only.