Workflow

Risk Assessment

Risk Assessment is a design-time safety feature that allows site administrators to proactively scan all active workflow rules for potentially cyclic rule combinations before they execute in a live environment.
While the platform already includes a runtime safeguard that halts cyclic rules during execution. However, that safeguard only activates after unnecessary messages have already been generated. Risk Assessment closes this gap by performing an advance scan and surfacing risks before they cause message explosions, slowdowns, or customer-facing incidents.
With a single click, Administrators receive a
plain-English, colour-coded
 report showing where risks exist and how severe they could be, without modifying any rules or disrupting production activity.
With Risk Assessment, site administrators can:
  • Detect
    cyclic workflow rules
     before they execute in production.
  • Identify
    multi-rule loops
     that are difficult to spot by reviewing rules individually.
  • Understand the
    potential impact
     of each loop using worst-case action counts.
  • Prioritise fixes using
    four risk levels
    : Safe, Caution, High, and Critical.
  • Review findings in a
    read-only, audit-friendly report
    .
  • Re-run scans as often as needed with
    zero impact on live workflows
    .
note
This requires site administrator permissions on the Workflow module, the workflow.risk-assessment.enabled feature flag set to true, and Workflow microservice version 3.4.0 or later.

Run Risk Assessment

To run a Risk Assessment for workflows:
  1. Navigate to
    Admin
     >
    Workflow
     >
    Rule builder
    .
  2. In the action bar, click
    Run Risk Assessment
     to start the analysis.
  3. A progress modal is displayed while the system evaluates your rules. During this process, the system:
    • Loads all active rules configured in the workflow.
    • Builds a dependency graph to map how rules interact with each other.
    • Detects cyclic combinations where rules may trigger each other in a loop.
  4. After the assessment is complete, a
    colour-coded report
     is displayed, highlighting any potential risks or issues.
  5. Expand any
    Rule loop(s)
     to view the group of rules involved.
  6. Update or correct the affected rules as needed to resolve identified issues.
  7. Rerun the risk assessment to verify that all issues have been addressed.
note
You can only view the results for up to 30 minutes after the scan finishes.
Consider the following
best practices
 when conducting Risk Assessments:
  • Run Risk Assessment
    regularly
     (weekly or fortnightly) as a routine health check.
  • Always
    scan before
     promoting major rule changes to production.
  • Fix issues in priority order:
    Critical
     →
    High
     →
    Caution
     →
    Safe
    .
  • Re-scan after every fix
     to confirm the cluster is fully resolved.
  • Preserve the original business intent of each rule when breaking a loop.
  • Capture screenshots
     of reports to maintain an audit trail.

Risk level classification

Each detected rule loop is assigned a risk level based on its worst-case action count, the maximum number of actions a single trigger could generate.
Risk Level
Worst-Case Action Count
Recommended Action
Safe
Up to 64 actions
Monitor; no immediate action required.
Caution
65–1,956 actions
Review and plan remediation.
High
1,957–109,600 actions
Prioritise for near-term resolution.
Critical
Over 109,600 actions
Fix immediately to prevent disruption.

Frequently Asked Questions

  • Will running a scan slow down my workflows?
    No. The scan runs on dedicated background threads and does not affect live workflow processing.
  • Can non-admin users access Risk Assessment?
    No. Only site administrators with workflow permissions can see or run the feature.
  • Does Risk Assessment change any rules automatically?
    No. The feature is strictly read-only. All remediation decisions remain under administrator control.
  • How accurate are the risk levels?
    Risk levels are based on conservative worst-case calculations. Actual runtime impact is often lower, but the system intentionally over-warns to ensure safety.
  • How long are scan results available?
    Results remain accessible for 30 minutes after the scan completes. Capture a screenshot if you need to retain findings beyond that window.

This article applies to:

  • Product: HighQ
  • Subject: Workflow