The workflow library
Who this is for: anyone sizing up what Liitora can do, and teams who want a working, reviewed workflow instead of a blank page.
Before you start: nothing, to read these pages. To take a workflow into use, you need the connections and company variables its own page lists, and someone in your company who can approve workflows.
Each workflow in the library is a complete, working Liitora workflow: real YAML, checked by Liitora’s validator, with its own test cases that pass against the real test runner. Nothing here is a mockup. The library test fails the moment one of them stops validating or breaks one of its own tests, so what you read here keeps working.
Each page starts with a one-line summary of what the workflow can use and do, and ends with its trust details: the publisher, the version, the content hash, the connections, company variables and secrets it needs, and the personal data it handles. Liitora checks those details against the workflow itself, so a page cannot claim less than the workflow does. See How the library is kept safe.
The first workflows are written for a bank’s security team, but the patterns apply to any regulated company: check access after someone leaves, review who holds privileged access, watch public feeds for new risk, and keep a clock on a regulatory deadline. Today every workflow in the library is published and reviewed by Liitora.
The workflows
Section titled “The workflows”- Leaver access check: when HR reports that someone left, check Microsoft Entra ID and your GitHub organisation for access that is still there, open a service desk ticket per remaining account, and email the owner.
- Quarterly privileged access review: on the first business day of each quarter, list the members of each privileged Entra ID group and email the owner a CSV to confirm or remove them.
- Known exploited vulnerabilities digest: every weekday morning, match new entries in CISA’s Known Exploited Vulnerabilities catalog against your software inventory and email security a CSV of the matches.
- New certificates for your domains: every hour, check crt.sh for new certificates on your domains and alert security, since a new certificate can be a phishing site or shadow IT.
- DORA major incident reporting clock: keeps the DORA major incident reporting clock (initial notification, intermediate report, final report) and reminds you before each deadline. People still write and send the reports.
To see what the library connects, open Integrations in the library: one page per connection template and per pair of systems that a library workflow connects, for example Microsoft 365 and GitHub, each with the trust summary of every workflow on it. There is no page for a system no library workflow connects.
How to use one
Section titled “How to use one”- Open the workflow’s page and read what it does, what it can access and what to set up.
- Create the connections and company variables it lists (see Create a connection and Use company variables).
- In Liitora, open Workflow library, find the workflow and ask to use it. Your AI assistant can make the request for you.
- A second person who can approve workflows approves the request. Liitora then checks the signature and copies the workflow into your company as a draft. See Take a library workflow into use.
- Run its tests, read the plain-language sentence on the approval page and approve the copy, the same way as any other workflow.
- Adapt it: the “How to adapt it” section on each page points at the parts most teams change first. Your copy is yours: later library versions are never applied to it.