Governance node for AI Agent workflows — PII scanning, cost budgets, and compliance audit trail

Feature Requests
1

The idea is:

A governance node that evaluates deterministic policy (PII detection, cost budget enforcement, tool-call authorization) before AI-generated actions execute. Place it between any AI node and an action node to scan content, enforce limits, and produce structured audit evidence — with no LLM in the governance path and <2ms latency.
Workflow placement:

[Webhook] → [Governance: PII Scan] → [AI Agent] → [Governance: Tool Auth] → [HTTP Request] → [Response]

The node would provide:

  • PII detection + redaction (SSN, credit card, email, phone, API keys) — pattern-based, deterministic
  • Per-execution cost budget with hard stop (kills the workflow when $X exceeded)
  • Tool/action authorization (allowlist/denylist for downstream nodes the AI agent can trigger)
  • Prompt injection detection on incoming user input
  • Structured JSON audit record per evaluation (correlation_id, findings, decision, latency)the idea in detail

My use case:

I run n8n AI Agent workflows in fintech that process customer data. Three concrete problems:

  1. Webhook input containing SSNs and credit card numbers flows directly into the OpenAI node — no scan, no evidence for auditors.
  2. The AI Agent node with tools looped 200+ times on a failing API call, burning $40 in a single execution. No cost cap stopped it.
  3. SOC2 auditors asked “prove that PII was evaluated before reaching the model for every request.” I had to build custom Function nodes to produce that evidence — fragile and non-standard.e cases to help us understand better. →

I think it would be beneficial to add this because:

  • Enterprise teams deploying n8n for AI workflows need compliance evidence (SOC2, HIPAA, PCI-DSS)
  • AI Agent node loops need cost caps — this is a safety issue, not just a nice-to-have
  • No other automation platform (Make, Zapier) offers a governance node — this would differentiate n8n for regulated environments
  • The node is simple: input → evaluate policy → passthrough or block. No complex logic, fast, deterministic.

Any resources to support this?

Are you willing to work on this?

Yes — I’ll build and publish it as a community node (n8n-nodes-tealtiger) using the TypeScript SDK. Happy to share a draft for feedback before publishing.

2 Likes
2

It won’t cover everything but have you checked out the Guardrails node yet?

3

Thanks @Jon — yes, I’ve looked at the Guardrails node. It’s great for LLM-output moderation (content filtering, format validation), but it doesn’t cover the governance gaps I’m hitting in production:

PII in input — the Guardrails node checks the model’s response, not what’s going into the model. Customer SSNs from a webhook flow into the OpenAI node unscanned.
Cost budget with hard stop — the Guardrails node doesn’t cap execution cost. My $40 runaway loop wasn’t an output quality problem, it was an unbounded iteration problem.
Structured audit evidence — the Guardrails node doesn’t produce SOC2-ready audit records (correlation IDs, timestamps, policy version, findings).
Tool authorization — no allowlist/denylist for what actions the AI Agent can trigger downstream.
The community node I’m building (n8n-nodes-tealtiger) is complementary — it sits before the AI node (input scanning + budget) and after the AI node (tool auth), while Guardrails handles output moderation. Different boundary, different problems.

Already have the node working: tealtiger/packages/n8n-nodes-tealtiger at main · agentguard-ai/tealtiger · GitHub

Would love your thoughts on whether this makes sense as a community node, or if there’s a better way to contribute this upstream.

4

There’s an existing solution for this that we’re using in our workflows, it sits in between on the outbound side of MCP and API requests to an external service. It doesn’t live inside n8n, rather prevents the PII from making it into n8n in the first place.

The problem you’re pointing out is real, particularly around SOC compliance, so the first layer of defense should be to ensure that PII never makes it into the workflow at all.

We’re using it to redact the data and also rate limit calls to AI and APIs depending on custom configured Meters and Limits.

I’d love to share it with you if you think it’d be worth giving it a go.

5

Hey @betterfortoday — appreciate this, and totally agree that defense at the perimeter is the right first layer. Preventing PII from entering the workflow in the first place is cleaner than catching it downstream.

That said, in my use case I still need an in-workflow layer for a few reasons:

1. **Not all inputs come from sources I control** — webhooks from third-party systems, customer-uploaded documents via n8n Form nodes, or RAG retrieval results from vector stores all bypass the outbound proxy.

2. **Tool authorization is per-action, not per-request** — the AI Agent decides *which* downstream node to call. That decision happens inside n8n after the LLM responds, so a perimeter layer can’t enforce “this agent is only allowed to call Slack and Sheets, not the admin API.”

3. **Audit evidence needs to be tied to the n8n execution** — SOC2 auditors want to see “for execution ID X, policy Y was evaluated at timestamp Z with verdict W.” That correlation only works if the governance check lives inside the workflow execution context.

Both approaches are complementary though — perimeter redaction + in-workflow enforcement is defense-in-depth. Would love to see what you’re using. Is it something like an API gateway with content inspection rules, or a custom MCP proxy?

Happy to share the TealTiger community node draft too — might be useful to compare approaches and see if they compose.

7

Quick update — the community node is now published on npm and ready to install:

**Install:** Settings → Community Nodes → Install → `n8n-nodes-tealtiger`

**npm:** https://www.npmjs.com/package/n8n-nodes-tealtiger

**What it does:**

Place the TealTiger Governance node before or after your AI Agent node. It provides:

- **PII scanning** — blocks SSN, credit card, email, phone patterns before they reach the LLM

- **Secret detection** — catches API keys, passwords, tokens in tool arguments

- **Cost budget** — hard-stop when session spend exceeds your limit

- **Tool authorization** — allowlist/denylist which actions the agent can trigger

- **3-way routing** — Approved / Blocked / Needs Review outputs for flexible workflow design

- **Structured audit** — JSON evidence record with correlation ID, findings, decision, and latency for every evaluation

**Workflow placement:**

```

[Webhook] → [TealTiger: PII Scan] → [AI Agent] → [TealTiger: Tool Auth] → [HTTP Request]

```

Uses TealGuard under the hood (deterministic evaluation, no LLM in the governance path, <2ms latency). Complementary to the built-in Guardrails node — Guardrails handles output moderation, TealTiger handles input scanning + policy enforcement.

Feedback welcome — especially around which policies you’d want to configure in the node UI. Happy to iterate.