Skip to main content
Back to all posts
5 minAgentic AI SecurityJune 26, 2026

Process Mining Should Come Before AI Workflow Redesign

Before assigning work to AI agents or Skills, inspect how the process actually runs. Event logs, variants, handoffs, exceptions, and baselines should shape the redesign.

RM

Ryan Macomber

Editor, VibeSec Advisory

Do not automate the workflow until you know how the workflow actually runs.

That sounds obvious. It is also the step teams skip when they get access to better AI tools.

The common move is to ask: "Which parts of this process can an agent do?"

The better first question is: "What is the process doing today?"

Not the diagram. Not the policy. Not the version a manager describes in a workshop. The actual path work takes through systems, handoffs, rework loops, exceptions, approvals, and waiting time.

That is where process mining becomes useful.

The process you think you have is usually not the process you run

Process mining uses event logs to discover, monitor, and improve real processes. The IEEE Task Force on Process Mining describes the field as extracting knowledge from event data, not from assumed process diagrams. Wil van der Aalst's work frames the core activities as discovery, conformance, and enhancement.

That distinction matters for AI workflow design.

If you only automate the process people think they run, you will miss the process they actually run. The actual process often includes skipped steps, late approvals, repeated handoffs, reopens, data cleanup, and exceptions that never made it into the official diagram.

Those details decide where AI belongs.

Frequency is not the same as automation fit

A task showing up often does not automatically make it a good AI candidate.

High volume can mean productive demand. It can also mean preventable rework.

A repeated handoff can mean healthy review. It can also mean unclear ownership.

A long cycle time can mean a bottleneck. It can also mean necessary human judgment.

Process-mining research separates discovery, conformance checking, variant analysis, and performance analysis. That gives teams a better starting point than "this task is repetitive." It helps them ask what the repetition means before they automate it.

Gross, Yeshchenko, Djurica, and Mendling make the important distinction: process mining identifies the as-is problem space, but it does not prescribe the to-be redesign. The redesign still requires judgment.

That is the right posture for AI.

Baseline first, agent second

Keep reading with free field-guide resources.

VibeSec Advisory publishes practical research, Skills, workflow examples, MCP notes, prompt injection tests, and AI red-team lessons for builders working with agentic AI.

The cleanest practical frame comes from the process-mining-for-Six-Sigma literature.

Define. Measure. Analyze. Improve. Control.

For AI workflow redesign, that means:

  1. Define the process boundary.
  2. Measure the current state.
  3. Analyze variants, waits, loops, exceptions, and handoffs.
  4. Improve the process design.
  5. Control the new workflow with review gates, metrics, and monitoring.

Do not skip from define to automate.

A useful baseline should include volume, throughput time, wait time, rework loops, compliance deviations, exception rate, reopen rate, handoff count, and outcome quality where available.

If the process touches customer communication, regulated data, credentials, payments, or irreversible actions, add approval points and escalation paths before giving AI more authority.

The model should not invent your metrics

There is a second lesson here.

Do not ask a model to infer exact workflow metrics from a narrative prompt.

A 2026 paper on agentic process mining, PMAx, points out the risk directly. LLMs can make process mining easier to access, but using them as direct analytical engines over raw event logs creates problems: deterministic reasoning, hallucinated metrics, and sensitive log exposure.

The safer pattern is separation.

Use deterministic scripts, BI tools, or process-mining tools to calculate the numbers. Let the AI interpret computed artifacts, summarize variants, draft hypotheses, and help write the Skill or review checklist.

That keeps the metric grounded.

It also keeps sensitive process logs out of places they do not belong.

Task mining fills the local gaps

Event logs do not show everything.

A workflow can look simple in a CRM or ticketing system while the real work happens in browser tabs, spreadsheets, email, chat, and copy/paste rituals.

That is where task mining, interviews, and screen-level observation matter.

Process mining gives the end-to-end flow. Task mining and human review explain the local work inside the boxes.

For knowledge work, you usually need both.

The field-guide version

Before writing a Skill or assigning an agent, build a small process evidence packet.

Include:

  • The process trigger and done state.
  • The systems that create event logs.
  • The top variants.
  • The known exceptions.
  • The handoffs.
  • The rework loops.
  • The current baseline metric.
  • The 90-day target.
  • The approval points.
  • The data boundary.
  • The failure mode that would make this unsafe.

Then decide what belongs where.

Some steps become Skills. Some become agent tasks. Some stay human. Some get removed because they were never real value. Some become review gates because the cost of being wrong is too high.

That is governed AI workflow design.

Not "what can the model do?"

"What does the process need, and what evidence proves it?"

Sources

AI Workflows Weekly

Read the archive

Practical notes on governed AI workflows, guardrails, and safer automation. No spam, unsubscribe anytime.

First-party signup with double opt-in. No embedded newsletter iframe, no analytics cookies, and unsubscribe anytime.

Keep testing agentic AI risk.

VibeSec Advisory is a free field guide. Use the research archive, Skill Library, and workflow examples to keep improving what you are building.