Protecting workflow security by up-front authorization and capacity-scoped cryptographic security context

A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:

• receiving a request to perform a workflow from a requestor;
• scanning a workflow definition of the workflow to identify maximum authorizations associated with the workflow, wherein the maximum authorizations include all authorizations required to execute the workflow and any child workflow, which is a child of the workflow;
• determining, prior to initiating execution of an instance of the workflow, whether the requestor has the maximum authorizations required to perform the instance of the workflow;
• generating an access token that is associated with the instance of the workflow only after determining that the requestor has the maximum authorizations required to perform the instance of the workflow, wherein the access token is configured for token-based authentication, and wherein the access token informs services used by the instance of the workflow that the requestor is authorized to access the services;
• generating a security context for the instance of the workflow, wherein the security context places limits on the instance of the workflow by defining a permitted service, wherein the security context is configured to limit a type of work requested for the instance of the workflow, scope a capacity of the work requested for the instance of the workflow, or define a path of the instance of the workflow, and wherein the security context is bound to the instance of the workflow;
• and
• performing the execution of the instance of the workflow in a computing environment,
• wherein each service accessed during the execution of the instance of the workflow determines whether to perform services based on the access token and the security context, including verifying that a requested service is within the permitted service, the workflow, or call path defined by the security context prior to performing the requested service, and
• wherein the security context places the limits on the instance of the workflow even when the requestor is otherwise authorized.