Citizen automation is the practice of allowing business users to create and run routine workflows without deep coding skills or specialist certification. It shifts repetitive operational work closer to the people who understand the process, while still requiring enough governance to keep automations safe, reliable, and aligned to business controls.
Expanded Definition
Citizen automation is the use of low-code or no-code tools that let business staff build routine workflows with limited engineering support. The term usually covers approvals, notifications, data routing, form handling, and other repetitive processes where process knowledge sits closer to the business than to IT.
It excludes custom software development, although the boundary can be blurry when a “simple” workflow grows into a business-critical dependency. Definitions vary across vendors, and no single standard governs the term yet, so governance expectations often matter more than the label itself. For that reason, many organisations treat citizen automation as a managed capability rather than an unrestricted self-service toolset.
That boundary is important because the same workflow can be either a productivity gain or a hidden control path, depending on who can change it and what data or system actions it can trigger.
Examples and Use Cases
Citizen automation often appears in teams that need faster handling of repeatable tasks without waiting for a bespoke application release cycle. The value comes from speed and local process knowledge, but the tradeoff is that reliability and oversight can drift if ownership is unclear.
- A finance analyst builds an approval flow that routes invoice exceptions to the right manager based on amount or vendor type.
- An HR coordinator automates onboarding reminders, form collection, and system handoff tasks across multiple departments.
- A support team creates a workflow that tags, assigns, and escalates incoming requests based on keywords and priority.
- An operations user links a spreadsheet, a ticketing queue, and a notification channel to reduce manual status updates.
In each case, the citizen-built workflow reduces repetitive work, but it also becomes part of an operational chain that must be understood, monitored, and retained when staff change roles.
Security Implications
Citizen automation can widen the attack surface when business users are allowed to connect data sources, credentials, or approval paths without strong guardrails. The main failure modes are excessive permissions, poor logging, unsanctioned data movement, and workflows that continue running after their owner leaves or the business process changes.
NHIMG research shows that only 5.7% of organisations have full visibility into their service accounts, which is a useful warning for automation-heavy environments because many citizen workflows ultimately depend on non-human credentials and backend integrations. When those dependencies are undocumented, revocation and review become unreliable.
Mismanaged workflows can also create shadow operational logic, where a process appears to be a business convenience but silently performs privileged actions, moves sensitive data, or bypasses normal approval controls. That makes failures harder to detect and harder to attribute.
If an automation platform is broadly trusted but lightly governed, the result is often not one dramatic failure but many small control gaps that accumulate across departments.
Domain and Governance Relevance
In NHI and access governance, citizen automation matters because business-built workflows often rely on machine credentials, API keys, service accounts, and delegated permissions behind the scenes. The user creating the workflow may not own those identities, yet the workflow still depends on their scope, rotation, storage, and revocation.
That creates a governance split between the person who understands the process and the teams responsible for identity, secrets, and platform control. When that split is not explicit, automations become difficult to audit and can outlive the business need that justified them.
NHIMG treats citizen automation as relevant to NHI governance whenever it turns a convenience workflow into a persistent identity-bearing control path. In practice, the real question is not whether the automation is “low-code,” but whether its permissions, data access, and ownership are visible enough to manage like any other production dependency.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | 5 — Account Management | Citizen automation often relies on shared or delegated accounts that need ownership and review. |
| 6 — Access Control Management | Low-code workflows can bypass normal approval boundaries unless permissions are controlled. | |
| 8 — Audit Log Management | Citizen-built automations need traceability for changes, triggers, and executed actions. | |
| Recommendation — Inventory automation accounts and remove orphaned or overprivileged access paths. Restrict workflow permissions to the minimum needed for each automation. Log workflow creation, modification, and execution events for review and investigation. | ||
| NIST CSF 2.0 | PR.AC — Access Control | Citizen automation affects how access is granted and constrained across business workflows. |
| DE.CM — Continuous Monitoring | Automation platforms need monitoring to detect misuse, drift, and unexpected execution. | |
| Recommendation — Apply least-privilege access to every workflow trigger, connection, and action. Monitor workflow activity for abnormal changes, failures, and unauthorized use. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secrets and Credential Management | Citizen automation often depends on API keys or service credentials behind the scenes. |
| Recommendation — Store automation credentials in managed secrets systems and rotate them regularly. | ||
