# Workflow Clinic 001: Handoff boundaries

- Status: synthetic method record
- Review date: 2026-08-21
- Method version: 1.0.0
- Human handoff decision: stop and correct before delivery

This is a reproducible teaching fixture. It contains no customer workflow,
credential, production endpoint, testimonial, or claim of a completed client
engagement. Every domain uses the reserved `.test` suffix and every visible
credential-like value is deliberately inert synthetic text.

## Fingerprinted inputs

| Input | SHA-256 |
| --- | --- |
| `clinic-001-baseline.json` | `b8fec13c99603085cc5bcf158257453b499e41a49f898b373910e606a3e5923e` |
| `clinic-001-candidate.json` | `1c3ad1461b630290307d7654d833e59af35d363ca50d7ad50c6e420a8ee5b234` |

## Automatic observations

The local static review marks the candidate as blocked. It detects a
credential-like literal, a runtime-resolved request destination, an
unauthenticated webhook, and a path from untrusted input to a write-capable AI
tool. Automatic observations are leads for review; they are not the human
handoff decision.

## False-positive record

No automated observation was confirmed as a false positive in this synthetic
case. The four observations were consolidated into three human blockers without
double-counting the shared request evidence.

## Human-validated blockers

### B-01: Authentication was removed at the intake boundary

- Evidence: candidate node `Public Intake` declares `authentication: none`.
- Impact: a caller can reach the workflow without the native boundary present
  in the accepted baseline.
- Boundary: static export evidence does not prove whether an upstream gateway
  adds authentication in production.
- Correction: restore a documented authentication boundary and record the
  production gateway evidence separately.

### B-02: User-controlled destination and a credential-like literal share one request

- Evidence: `Read Callback Target` copies `body.callbackUrl`; `Send Callback`
  uses that value as its URL and contains an inert literal authorization value.
- Impact: if shipped as shown, untrusted input can choose where the request is
  sent and credential material may be exposed with it.
- Boundary: the fixture is never executed and the literal token is not valid.
- Correction: use an explicit destination allow-list, an n8n credential
  reference, bounded timeouts, and a failure route.

### B-03: An AI-controlled email action has no visible approval gate

- Evidence: `Send Client Email` is connected to `Draft Client Reply` as an
  `ai_tool`; no approval node appears on that path.
- Impact: untrusted message content may influence a side effect without a
  recorded person-in-the-loop decision.
- Boundary: the static export cannot prove external policy enforcement or
  actual runtime permissions.
- Correction: require an explicit approval step before the email action and
  verify the SMTP credential scope in the target environment.

## Not established

This record does not establish runtime execution order, production identity,
credential permissions, delivery to any external system, business correctness,
penetration-test coverage, compliance, certification, or security.