Zero-Trust Architecture for AI Workflow Builders: Securing AI-Powered Business Automation Tools

Abstract

Coupling Large Language Models (LLMs) to low-code platforms compresses business-automation delivery cycles. Yet, the resulting composable architectures expose attack surfaces that perimeter-based controls were never designed to police. We propose the Zero-Trust Automation Lifecycle (ZTAL), a methodology that threads continuous Zero-Trust verification throughout the twelve-stage low-code development process. Three phases (Prepare, Mitigate, Optimize) operationalize the "never trust, always verify" doctrine while emitting security artifacts (visual policy matrices, verified configuration screenshots) as by-products of ordinary development work. We present a functional reference implementation of ZTAL together with an evaluation design spanning security, performance, and usability. Against representative threat scenarios (prompt injection, data exfiltration, over-privileged access, and classification breach), the reference implementation enforces deny-by-default policy at every internal surface: each scenario is blocked at its enforcement point while benign traffic passes. Illustrative target figures used to scope the study (a substantial reduction in Policy Violation Rate against a legacy perimeter baseline, policy-evaluation overhead in the tens of milliseconds per request, and micro-segmentation coverage rising from partial to near-complete) are reported as expected outcomes of the instrumented evaluation set out in the methodology, not as completed measurements. The framework offers practitioners an artifact-driven blueprint for securing composable AI systems and a working reference implementation on which the full empirical validation can be conducted.