n8n + LLM Gateway
Validate Before the Business Actionn8n + LLM 网关：先验证模型输出，再执行业务动作
A workflow turns model output into actions. Protect that boundary with scoped credentials, strict output validation, idempotency and an explicit error branch.
工作流会把模型输出转成动作。使用受限凭证、严格输出验证、幂等与显式错误分支保护这一边界。
TL;DR
Send workload alias, required capabilities, trace and deadline.
Parse and check schema before any downstream action.
Choose workflow or gateway retry ownership and share a budget.
Deduplicate updates, messages and external calls.
发送工作负载别名、所需能力、调用链与截止时间。
任何下游动作前解析并检查结构定义。
选择工作流或网关重试归属并共享预算。
去重更新、消息与外部调用。
A production workflow path生产工作流路径
The trigger prepares redacted input and trace context, calls the gateway, validates the response and only then enters the business action node.
触发节点准备经过脱敏的输入和调用链上下文，调用网关并验证响应，确认通过后才进入业务动作节点。
Make each transition explicit in the n8n canvas. A trigger payload should become a canonical request with a workflow ID, execution ID, tenant, data classification and deadline. The gateway response should pass through a validation node that checks status, schema, required fields and confidence or evidence rules before any email, database update, ticket change or financial action is allowed.
n8n 画布中的每次状态迁移都应明确可见。触发请求应被整理为规范格式，包含工作流 ID、执行 ID、租户、数据分类和截止时间。网关响应必须先经过验证节点，检查状态、结构、必填字段，以及置信度或证据规则，之后才允许发送邮件、更新数据库、修改工单或执行金融动作。
Failures take a named branch for retry, compensation, alert or controlled stop. Credentials remain in the platform credential store, not node text or exported workflow JSON. Use separate credentials per environment and restrict which workflows can access them.
故障应进入具名分支，分别执行重试、补偿、告警或受控停止。凭证应保存在平台凭证库中，而不是节点文本或导出的工作流 JSON 里；不同环境使用独立凭证，并限制哪些工作流可以访问。
Design for delayed and duplicate triggers. Webhooks, queues and scheduled jobs can deliver the same logical event more than once, while long model calls can outlive an upstream timeout. Derive an idempotency key from the business event, store the current workflow state and reuse the same trace when a waiting execution resumes. This keeps an innocent retry from creating a second side effect.
还要考虑延迟与重复触发。Webhook、队列和定时任务可能多次投递同一个逻辑事件，而较长的模型调用可能超过上游超时时间。应根据业务事件生成幂等键，保存当前工作流状态，并在等待中的执行恢复时复用同一调用链，避免一次正常重试制造第二次副作用。
Workflow stages and controls工作流阶段与控制
| Stage阶段 | Best fit最适合 | Verify before choosing选择前验证 |
|---|---|---|
| Trigger and input触发与输入 | Webhook, schedule, queue or event.Webhook、Schedule、Queue 或 Event。 | Authenticate source, redact data and assign idempotency key.认证来源、脱敏数据并分配 Idempotency 密钥。 |
| Gateway call网关调用 | Stable endpoint with workload alias and trace.带工作负载别名与调用链的稳定端点。 | Set deadline, capability flags and one retry owner.设置截止时间、能力 Flag 与单一重试负责人。 |
| Validation验证 | Parse strict structured output.解析严格结构化输出。 | Reject missing, extra or unsafe fields before actions.动作前拒绝缺失、多余或不安全字段。 |
| Action or error动作或错误 | Execute idempotent business step or named failure branch.执行幂等业务步骤或命名故障分支。 | Log outcome, compensate partial work and alert with trace ID.记录结果、补偿部分工作并用调用链 ID 告警。 |
Workflow hardening checklist工作流加固检查
Use platform-managed secrets per environment and workflow.
Keep trigger, gateway and downstream deadlines consistent.
Treat model output as untrusted input.
Carry traceparent or a stable correlation ID through every node.
按环境与工作流使用平台管理上游密钥。
保持 Trigger、网关与下游截止时间一致。
把模型输出视为不可信输入。
让 traceparent 或稳定 Correlation ID 贯穿每个 Node。
Test the workflow as a state machine把工作流当作状态机测试
Do not validate only the successful path from trigger to action. Enumerate states such as received, normalized, inference pending, validated, awaiting approval, action pending, completed, compensated and failed. For every transition, define who can initiate it, what evidence is required and whether replay is safe.
不能只验证从触发到动作的成功路径。应列出“已接收、已标准化、等待推理、验证通过、等待审批、等待执行、已完成、已补偿、已失败”等状态。对每次迁移都要明确谁可以发起、需要哪些证据，以及是否能够安全重放。
- Replay valid, malformed, delayed and duplicate trigger payloads.
- Inject gateway timeout, 429, partial response and invalid schema.
- Verify no failure can execute the business action twice.
- Exercise compensation, alerting and manual replay with trace evidence.
- 回放有效、异常、延迟和重复的触发请求。
- 注入网关超时、429、部分响应和无效结构。
- 确认任何故障都不会让业务动作执行两次。
- 演练补偿、告警和带调用链证据的手动重放。
Use representative payload sizes and production-like timing. A workflow that succeeds with a short test prompt may fail when retrieval context approaches the model limit or when a stream stalls after the first chunk. Check n8n execution duration, memory, queue behavior and error-workflow delivery as well as model latency and output quality.
测试应使用具有代表性的请求体大小和接近生产环境的时序。一个使用短提示词能够成功的工作流，可能在检索上下文接近模型限制时失败，也可能在流式输出首块后停滞。除模型延迟和输出质量外，还要检查 n8n 执行时长、内存、队列行为与错误工作流是否成功送达。
Put a validation gate before side effects在副作用前设置验证关卡
The workflow prepares a canonical request, calls the gateway and validates the returned schema. Only a verified result enters an idempotent action. Every other state routes to a controlled error branch with trace evidence.
工作流先准备规范请求，调用网关并验证返回结构。只有通过验证的结果才能进入幂等业务动作，其他状态全部转入带调用链证据的受控错误分支。
Validation should be deterministic wherever possible. Parse JSON into typed fields, reject unknown enum values, enforce numeric bounds, verify identifiers against the source system and check that required evidence or citations are present. Natural-language checks performed by another model can supplement these rules, but they should not be the only protection before an irreversible action.
验证应尽可能采用确定性规则。把 JSON 解析为有类型的字段，拒绝未知枚举值，限制数值范围，根据源系统核对标识符，并确认必需的证据或引用存在。另一个模型执行的自然语言检查可以作为补充，但不能成为不可逆动作前的唯一保护。
Insert human approval where the consequence or uncertainty requires it. The approval record should show the original trigger, normalized input, model output, validation result, proposed action and relevant source evidence. If the approval expires or the underlying data changes, return to validation rather than executing an old decision.
当后果严重或不确定性较高时，应加入人工审批。审批记录需要展示原始触发、标准化输入、模型输出、验证结果、拟执行动作和相关来源证据。如果审批过期或底层数据已经变化，应返回验证阶段，而不是继续执行旧决策。
Production rule: model output must never directly authorize a destructive or irreversible action.
生产规则：模型输出绝不能直接授权破坏性或不可逆动作。
Use QVeris for governed workflow capabilities用 QVeris 治理工作流能力
QVeris lets the workflow discover and call external APIs, tools, services and live data. Keep each capability scoped, validated and idempotent, and join it to the gateway request trace.
QVeris 让工作流发现并调用外部 API、工具、服务和实时数据。每项能力都应限制权限、完成验证并具备幂等性，同时与网关请求调用链关联。
Use Discover during design to find candidate capabilities, then Inspect to record the required schema, provider coverage, permissions, expected latency and cost. Pin the chosen capability or acceptance criteria in the workflow configuration so a future catalog change does not silently alter a production action.
设计阶段先通过“发现”寻找候选能力，再通过“检查”记录必填结构、供应商覆盖、权限、预期延迟和成本。在工作流配置中固定所选能力或验收条件，避免能力目录未来变化时悄悄改变生产动作。
At runtime, pass the n8n execution ID and business idempotency key with the capability call. Validate timestamps, units, entity identifiers and provider errors before the result continues to the action node. Store the QVeris search and execution IDs beside the n8n execution so an operator can reconstruct both the workflow decision and the external call.
运行时把 n8n 执行 ID 和业务幂等键一并传给能力调用。在结果进入动作节点前，验证时间戳、单位、实体标识和供应商错误。将 QVeris 搜索与执行 ID 同 n8n 执行记录保存在一起，运营人员即可同时还原工作流决策与外部调用。
Build an n8n gateway call that can be replayed构建可重放的 n8n 网关调用
Use an HTTP Request node when a gateway operation is not exposed by a built-in node. Keep the credential in an n8n credential object, not workflow JSON, and emit a compact evidence object after every call so a failed workflow can be diagnosed without exposing prompts or secrets.
当内置 Node 没有暴露网关操作时，可使用 HTTP 请求 Node。凭证应保存在 n8n Credential Object 中，而不是 Workflow JSON；每次调用后输出精简 Evidence Object，便于在不暴露提示词或上游密钥的前提下诊断失败工作流。
Method: POST
URL: {{$env.LLM_GATEWAY_BASE_URL}}/chat/completions
Authentication: Predefined credential type
Headers:
Content-Type: application/json
Body (JSON):
{
"model": "{{$json.model_alias}}",
"messages": "{{$json.messages}}",
"stream": false,
"metadata": {"workflow_id": "{{$workflow.id}}", "execution_id": "{{$execution.id}}"}
}
Output evidence:
{
"request_id": "{{$json.id}}",
"model": "{{$json.model}}",
"usage": "{{$json.usage}}"
}- Use Continue On Fail only when a following branch classifies the error explicitly.
- Set an execution timeout and cap retries at one layer.
- Test manual execution, scheduled execution, partial input, 429, 5xx, and credential rotation.
- 只有后续分支明确分类错误时才使用 Continue On Fail。
- 设置执行超时，并只在一层控制重试。
- 测试手动、定时、部分输入、429、5xx 与凭证轮换。
Verified implementation reference: n8n HTTP Request node.
实施参考已根据官方资料核验：n8n HTTP 请求 node。
FAQ
Choose one owner for model retries; use workflow retries only for explicit state transitions.
With a strict schema and a failure branch before actions.
Use stable idempotency keys and deduplication at the downstream system.
选择一层负责模型重试；工作流重试只用于显式状态转换。
在动作前使用严格结构定义与故障分支。
使用稳定 Idempotency 密钥与下游系统去重。