Workspace-Scoped AI Workflows: Keep AI Employees Inside the Right File Boundary

Workspace-Scoped AI Workflows are workflows that restrict an AI employee's file reading, file modification, and artifact output to a clearly defined workspace. Office teams ask Agents to read PDFs, spreadsheets, Word files, email attachments, and exported web data every day. The repetitive, manual, error-prone part is obvious. The quieter risk is more operational: the Agent may read the wrong material, overwrite the wrong file, or leave a draft where the team expected a final artifact. Axon's workflow-first model needs file boundaries before it can claim reliable execution.

NIST's AI Risk Management Framework treats AI risk as something managed across the system lifecycle. In office AI, file scope is one of the most practical risk layers. For Axon, System Skills, User Skills, and Agent Pipelines should organize inputs, working copies, and artifacts around a workspace instead of letting an Agent roam across a device or drive.

An AI employee is not smarter because it can see everything. It is safer and more useful when it sees the files authorized for this workflow and writes outputs where they can be accepted.

File safety is not just a permission popup

A permission popup can ask whether access is allowed. Workspace-Scoped AI Workflows answer a more useful set of questions:

File object	How it should be handled	Common failure
Source Data	Read-only input for this run	Agent uses old material
Working Copy	Writable intermediate file	Draft overwrites the official file
Artifact Path	Final output location and naming rule	Result only exists in chat
Blocked Path	Host paths the workflow cannot touch	Private or system files are read

This connects directly to Source Data fields. Source Data defines what material the task needs. The workspace boundary defines how that material enters the run and where the Agent is not allowed to go.

A usable workspace boundary

workspaceBoundary:
  workflow: "monthly customer renewal brief"
  sourceData:
    readOnly:
      - "/workspace/input/customer-contract.pdf"
      - "/workspace/input/usage-export.xlsx"
      - "/workspace/input/support-ticket-summary.md"
  workingCopies:
    writable:
      - "/workspace/work/renewal-analysis.md"
      - "/workspace/work/risk-table.csv"
  artifacts:
    final:
      - "/workspace/output/renewal-brief.md"
  blocked:
    - "/Users/*"
    - "/Downloads/*"
    - "/workspace/input/* overwrite"

This is not bureaucracy. It gives the Agent, the Skills, and the business owner the same understanding of what can be read, what can be changed, and what counts as delivery.

Working copies protect source material

Most file incidents are not malicious. They come from unclear automation paths. A contract summary workflow that writes next to the original contract can mix source material, draft comments, and final review notes. A better structure is straightforward:

• Original files enter input and are read-only by default.
• Skills write intermediate work into work.
• Accepted outputs go into output.
• Outbound or overwrite actions enter Trust Mode.
• The run record preserves source, work, and output relationships.

That structure gives workspace artifact acceptance a real object to inspect. The accepted item is not a chat response. It is a located artifact that can be reviewed, reused, and traced.

Three file actions that should stop the workflow

Overwriting input material.
Input files are evidence, not scratch paper. If the Agent must clean or transform material, it should create a working copy.

Searching outside the workspace.
If the workflow cannot find required material, the correct state is exception, not a wider search. A Workflow Runtime Contract should define missing input as a known exception.

Leaving the final result in chat.
Chat is not a business delivery layer. Reports, tables, checklists, and email drafts should land in an artifact path and connect to Source-to-Decision Lineage.

A practical review before scheduling

Before a file-heavy Axon Agent gets scheduled, review the boundary:

1. Confirm that every Source Data file is inside the workspace input area.
2. Identify writable files and keep them in a working-copy area.
3. Fix the final artifact path and naming rule.
4. Make missing files visible as exceptions with partial work attached.
5. Check that personal folders, download folders, and unrelated project folders are blocked.

If the last point cannot be answered, the workflow is not ready for automatic execution.

Workspace Boundary Questions

Q1: Do Workspace-Scoped AI Workflows reduce Agent capability?
They reduce random access. They do not reduce business capability. Most office workflows need the right material, not an unlimited file range.

Q2: What if the user adds a file during the run?
The file should be brought into the workspace and recorded as Source Data. The Agent should not read directly from an external path.

Q3: Why not let the model decide which files are relevant?
The model can help classify material, but it should not define the authorization boundary. File scope and evidence lineage belong in the workflow.

Start with one file-heavy task

Choose one Axon Agent that handles real files, such as contract summaries, renewal briefs, or monthly operating reports. Define input, work, output, and blocked paths before the Skill chain starts. Explore Source Data, artifact acceptance, and evidence lineage, then reuse the Workspace-Scoped AI Workflows pattern for higher-risk file tasks.