How the library is kept safe

Who this is for: admins and security reviewers who want to know why they can trust a workflow from the Liitora library.

Before you start: it helps to read How Liitora keeps you safe and How AI agents are kept safe first.

A workflow from a library is code that someone else wrote. Liitora treats it that way: it checks the workflow before showing it, checks it again before copying it, and lets two people decide. The copy then goes through the same tests and approval as a workflow you wrote yourself.

Who publishes

Today every workflow in the library is written, tested and published by Liitora, under the Apache 2.0 licence. Each one is a complete workflow with at least three test cases, and Liitora’s own tests fail the moment one stops validating or breaks one of its test cases.

What the trust details promise

Every library workflow comes with a one-line summary of what it can use and do, and trust details: its connections, company variables, secrets, whether it remembers anything between runs, and the personal data it handles. Liitora reads the connections, company variables, secrets and saved state from the workflow itself when it publishes the library, and refuses a workflow whose details don’t match. A workflow that says it needs no secrets but reads one is never published. The personal data statement is written and reviewed by the publisher.

Signed and checked

Liitora computes a content hash over everything that makes up a version: the workflow, its tests, its read me and its trust details. Change one character and the hash changes.
Liitora signs that hash with a key that only the Liitora service can use. The key lives in a key vault and never leaves it.
Each time the library is shown, Liitora checks the hash and the signature again. A version that fails either check isn’t shown at all, not even with a warning.
When a library request is approved, Liitora checks the hash and the signature once more, in the same step that copies the workflow. What gets copied is exactly what was checked.
If the vault can’t be reached, the library shows nothing and says it can’t be checked right now.

Nothing in a library workflow runs when it is listed, read or copied. It runs only after your copy has passed its tests and a person approved it.

Two people decide

Anyone who can edit workflows may ask for a library workflow, and so can their AI assistant.
A different person who can approve and edit workflows approves the library request. The server enforces this, and so does the database. A decision is final.
An AI assistant can never approve. A request it made for a person counts as that person’s request, so that person can’t approve it either.
A company with only one approver may approve its own request for a workflow published by Liitora, after confirming on purpose. A company that requires a second approver never gets this exception.
Each step is in the audit log: the request, the approval or rejection, and the copy with its content hash.

Your copy is yours

The copy is a draft workflow of your company. It records which library workflow, version and content hash it came from.
Only your company sees your requests and copies.
Liitora never changes a copy. A newer version is offered, never applied. Before you ask for it, Liitora shows what the newer version adds or changes: where it sends data, its connections, secrets, actions and scripts. An update is when trusted code could quietly gain access, so that is shown first.
If Liitora finds a problem in a version, it flags it. A flagged version takes no new requests, and its page says what’s wrong. A flag is never taken back; a fix comes as a new version.
Companies holding a copy of a flagged version get an alert, and their admins get an email. Liitora finds the copies from its own record of what each company copied and the content hash it copied, never from anything a person or a client sends, and each company sees only its own copies.
People who may pause workflows can pause every running copy of the flagged version in one step. It needs the same permission as a normal pause, and each pause is recorded in the audit log with the flagged version.