Post

Modelling workflows independently of eg Cowork, Codex, Managed Agents etc gives you auditing, automatic optimisation, and intentional security boundaries. AWML shows who does each step, where information crosses permission boundaries, and which platform runs it.

The refused read is the line I'd want most. One question from testing AI-written code: scopes are sets of people, so when one person owns both the AI step that writes the code and the check's expected results, can AWML still draw that the writing step must never read them?

Scopes aren't just sets of people - they represent any permission boundary, so yes this should be possible. Do try it and let me know if you get stuck!

0 reposts0 likes

Thanks, that's clear. Then the part a drawing can't hold, as your README says, is the record: that the expected results existed, unchanged, before the writing step ran. Where would you keep that record so someone outside the workflow could check the order?

Ah, that would be in a supporting platform that could check the AWML was adhered to. This doesn't run any work, just describes it.

That split makes sense: AWML describes, something else enforces. One question on that platform: would it sit inside the same scope as the team whose AI step writes the code, or outside it, so that team can't change what it checks?