AI agents inside BPMN: keeping the process in charge

An AI agent stays under control when it works inside a BPMN process rather than around it. With the Camunda AI Agent connector, the agent handles the step that needs judgement, DMN rules decide what your policy already defines, people approve what carries risk, and the process records each decision in its audit trail.

Camunda 8.8, released in October 2025, brought agentic orchestration to Camunda 8. The Camunda AI Agent connector places a large language model inside a BPMN process as one of its steps. The agent receives its context from process variables, can use the tools the process model gives it, and returns its result to the process, which decides what happens next.

The difference from an agent that runs on its own is ownership. The BPMN model defines the order of the steps, the timeouts, the escalations and the end states. The agent works inside its step and can only use the tools the model gives it. If the agent fails or takes too long, the process handles it like any other failed task: with a retry, an escalation or a person.

A process with an AI agent holds three kinds of decision, and each belongs in a different place.

• The agent decides where reading and judgement over unstructured input are needed: classifying an incoming message, extracting fields from a document, drafting a reply, proposing the next action.
• The rules decide what your policy already defines. Thresholds, eligibility, routing and limits belong in a DMN decision table, not in a prompt. A DMN table gives the same answer to the same input every time, and a reviewer can read it line by line.
• People decide where the effect on a person is significant or the financial risk passes a limit you set. A user task puts the decision in front of a named person, who approves, rejects or corrects the proposal of the agent.

One pattern combines the three: the agent proposes, a DMN table checks the proposal against policy, and a user task handles what the table does not accept.

For each run of an AI agent, the process should record:

• the input the agent received, or a reference to it;
• the model and its version, and the version of the instructions it was given;
• the tools it called and what they returned;
• its output, and the rule decision that followed;
• the person who approved or corrected it, and when.

Store large inputs, such as documents, by reference in their own store, not as process variables. The audit trail then answers the two questions an auditor asks: what did the agent see, and who let its proposal through?

An AI agent is only as good as the data it reads. Give each agent step only the fields that step needs, fetched through the integration layer or a service you control, not through direct access to a database. Name the source of each field in the model, so that a wrong answer can be traced to a wrong input. Check the input before the agent sees it: a DMN table or a job worker that rejects incomplete data costs less than an agent that guesses.

The rules below shape the design of a process with an AI agent. What follows is technical and governance work, not legal advice: your legal team decides how the law applies to your use case.

The EU AI Act. Regulation (EU) 2024/1689 entered into force on 1 August 2024. The prohibited practices and the AI literacy duty apply from 2 February 2025, and the obligations for general-purpose AI models from 2 August 2025. The general date of application, the transparency duties of Art. 50 included, is 2 August 2026. The AI Omnibus, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and moved the high-risk dates: the rules for high-risk AI systems in Annex III apply from 2 December 2027, and those for high-risk AI in products under Annex I from 2 August 2028.

Whether your agent is a high-risk system depends on its use case, not on the technology. Classifying it is a joint task for your legal team and the engineers who know what the system does.

The GDPR. A process that uses personal data in a new way with an agent may need a data protection impact assessment (DPIA). Art. 22 concerns decisions based solely on automated processing that produce legal or similarly significant effects for a person. A user task where a named person decides is one technical way to keep a person in such decisions; whether it is enough is for your legal team to judge.

ISO/IEC 42001. ISO/IEC 42001:2023, published in December 2023, sets out requirements for an AI management system. Preparing for it is governance work: policies, roles, risk assessment and records. A certificate comes from an accredited body, never from a consultancy.

DORA. For banks and insurers, DORA is context: an agent inside a process is part of the ICT that your operational resilience work has to cover, and your legal and risk teams decide what that requires.

A BPMN process already holds much of what governance asks for: a documented model of what happens, the points where people decide, and a record of each case.

Start an AI agent project with one process where the agent reads and proposes and a person still decides. Pick a process with a clear owner and a decision that a person already makes by reading documents or messages. Track how often the person corrects the agent, and move a decision to the rules or to the agent only when that record supports it.

How we build agents into governed processes, with the data behind them, is on the page AI agentic development. The rules side of the work is on AI compliance.