WorkBuddyGuide

WorkBuddyGuide Security Hardening

Least-privilege permissions

• Audit example credentials before use: The tutorial includes sample usernames and passwords for testing. Before running workflows in real work, replace all placeholders with actual credentials that have only the minimum permissions needed (for example, read-only access instead of delete access).
• Restrict connector scopes: When connecting WorkBuddy to external services (like email or file storage), grant only the specific permissions the workflow requires—not blanket access to everything.
• Review shared workflows: If using pre-built workflows from the community, check what data each skill (mini-program) is allowed to access before enabling it in your organization.
• Rotate credentials regularly: Change passwords and access tokens for accounts linked to WorkBuddy at least every 90 days, especially for admin accounts.

Network isolation

• Run agents on private networks: Deploy WorkBuddy agents (the AI workers executing tasks) on internal networks only, not on public-facing servers where unauthorized users can reach them.
• Use VPN for remote access: If remote teams need to access WorkBuddy, require a VPN connection rather than direct internet exposure.
• Validate connector sources: Before installing a connector (a bridge linking WorkBuddy to another tool), verify it comes from the official WorkBuddy repository or a trusted vendor—malicious connectors can steal data.
• Whitelist external services: Only allow WorkBuddy agents to communicate with approved external services by restricting outbound network connections.

Monitoring

• Log all workflow execution: Enable logging to record what each workflow does, which data it touches, and who triggered it—store logs in a central, tamper-proof location.
• Review agent activity daily: Assign someone to check logs for unusual patterns, such as workflows accessing sensitive data at odd times or connector failures.
• Track dependency updates: Monitor for security patches in WorkBuddy itself and its connector libraries (upstream packages); apply critical updates within 48 hours.
• Set up alerts for failed authentication: Configure notifications when someone repeatedly fails to log into WorkBuddy or when a connector loses credentials.

Red flags to watch for

• Unexpected data exports: If a workflow suddenly begins copying files or sending data outside your organization, pause it immediately and investigate.
• Unusual prompt behavior: If an AI agent responds to requests in a way that contradicts its intended guardrails (for example, ignoring a "do not delete" instruction), treat it as a potential prompt injection attack and isolate the workflow.
• Untracked changes to workflows: If a workflow's configuration changes without authorization, roll back to the last known-good version and audit who had access.
• Slow performance or missing logs: If WorkBuddy becomes sluggish or stops recording activity, it may indicate a breach or misconfiguration—stop using it and contact your IT team.