Governing n8n workflows without touching them

The fastest way to lose a governance programme is to ask the teams who built the automations to rebuild them. So don't. A policy decision point can sit in front of the consequential step of a workflow without changing what the workflow does.

One node, one consent

Install the community node, add a Kimetai credential and click Connect once. That single OAuth consent links the n8n instance to your tenant, and the inventory of what runs there starts filling in immediately — before you have written a single policy.

n8n-nodes-kimetai

Where to place it

Not at the start of the workflow, and not at the end. Immediately before the step that spends money, moves personal data or touches a customer. Everything upstream of that node can keep working exactly as it was built; the node only decides whether the next step is allowed to happen.

{  "verdict": "ALLOW",  "policy": "eu-default-v3",  "token": "kmt_auth_9f2c41…",  "expires_in": 60,  "audit_event": "evt_48213"}

Wiring the three verdicts

• ALLOWgoes straight to the action node you were already using.
• REVIEWgoes to a human approval step — Slack, email, or a wait node.
• BLOCKgoes to a stop, with the reason already recorded.

Every one of those verdicts is sealed in the audit trail as it happens, so the record exists whether or not anyone ever asks for it. That is the part you cannot retrofit later.

Two things worth doing first

Simulate the policy against your last 30 days of traffic before you enforce it — a rule that would have blocked a legitimate month of purchase orders is a rule you want to discover in a report, not in an incident. And name the backing human for the workflow while you are in there: an authorised action with no accountable person is only half a control.