A regulated workflow is any business process that performs an activity covered by law or licensing, such as customer onboarding, wallet custody, transfer approval, or sanctions screening. In crypto, the workflow itself must be mapped to the identities that can execute it and the rules that govern it.
Expanded Definition
A regulated workflow is not just a business process with compliance obligations. In NHI and IAM practice, it is a workflow whose execution rights, approvals, evidence, and downstream actions must be tied to specific identities, policy conditions, and auditability requirements. That includes human operators, service accounts, API keys, machine tokens, and AI agents when they are permitted to initiate or complete regulated steps.
Definitions vary across vendors and industry guidance on where workflow control ends and identity control begins, but the practical boundary is clear: if an action can create legal, licensing, custody, or sanctions exposure, the workflow must be governed as a controlled access path. That aligns with NIST Cybersecurity Framework 2.0 principles for governed access and traceable operations, even when the workflow is implemented in automation rather than a traditional application.
The most common misapplication is treating a regulated workflow as a generic business automation task, which occurs when teams approve the process but do not map the identities, privileges, and evidence trail required for each regulated action.
Examples and Use Cases
Implementing regulated workflows rigorously often introduces friction in the form of approval latency, stricter logging, and narrower access paths, requiring organisations to weigh compliance assurance against operational speed.
- Customer onboarding in a crypto exchange, where identity verification, risk scoring, and account activation must be performed only by approved services or operators with traceable authority.
- Wallet custody operations, where signing authority should be limited to tightly governed NHIs rather than broad service roles that can be reused across environments.
- Transfer approval flows, where dual control, step-up authentication, and recorded evidence help ensure that a high-risk movement is attributable and reviewable.
- Sanctions screening pipelines, where the workflow must preserve decision provenance so investigators can show which identity, model, or service produced the outcome.
- Audit preparation for regulated automation, where evidence from Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs can be used to prove rotation, offboarding, and authority boundaries.
For teams aligning processes to control requirements, Ultimate Guide to NHIs — Regulatory and Audit Perspectives is useful because it frames how regulated activity should be evidenced, not just executed.
Why It Matters in NHI Security
Regulated workflows matter because compromised or overprivileged NHIs can turn routine automation into reportable exposure. NHIMG research shows that 97% of NHIs carry excessive privileges, which means a workflow that was intended to handle one bounded regulated action can silently gain the ability to approve, move, or disclose far more than intended.
When the workflow is not identity-bound, audit teams cannot reliably answer who or what executed a regulated step, whether the right policy gate was present, or whether an API key or service account had enough access to bypass segregation of duties. That creates legal and operational risk in custody, onboarding, transaction approval, and screening decisions. The same issue also appears in post-incident response, where traceability becomes critical after an exception or unauthorized action.
Top 10 NHI Issues is a strong reference for the control failures that commonly surface when regulated automation is not governed end to end. Organisations typically encounter the need to formalise regulated workflows only after a failed audit, blocked transfer, or unauthorized approval exposes that the process had no defensible identity and policy boundary.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Regulated workflows depend on governed NHI execution paths and constrained privilege. |
| NIST CSF 2.0 | PR.AC-4 | Least-privilege access is central when workflows trigger licensed or legal obligations. |
| NIST Zero Trust (SP 800-207) | Zero Trust requires every regulated step to be explicitly authenticated and authorized. |
Map each regulated action to a specific NHI, then restrict and review its permissions continuously.
Related resources from NHI Mgmt Group
- Who is accountable when a regulated transfer workflow fails audit review?
- How should regulated teams evaluate cloud-private identity governance platforms?
- How should regulated teams decide between shared SaaS and tenant-owned identity platforms?
- How should security teams evaluate cloud identity tools in regulated environments?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on July 4, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
