Workflow as Knowledge: Semantic Persistence for LLM-Mediated Workflows
Source: arXiv:2607.08740 · Published 2026-07-09 · By Emanuele Quinto, Carlo Andrea Rozzi, Francesco Zanitti
TL;DR
This paper addresses the representational challenges in managing LLM-mediated workflows, which today are often fragmented across source code, runtime state, logs, and chat histories. The authors propose a conceptual model inspired by Lisp symbolic forms and live-image programming, where workflow definitions, running instances, inference records, and context snapshots are semantic, persistent knowledge objects in a shared substrate. Central to this model is the semantic distinction between deterministic state derivations (derive) and mediated LLM judgments under controlled policies (infer). Unlike conventional workflow or agent systems that focus on execution persistence (managing runnable state and logs), this approach treats workflows themselves as inspectable, resumable, and queryable knowledge entities, enabling review, provenance, and knowledge continuity beyond individual executions. The model is primarily conceptual, leaving formal semantics and implementation to future work.
Key findings
- Workflow definitions should be represented as typed, persistent semantic objects, not only as executable code or configuration.
- Workflow instances must persist as live objects capable of serving as semantic checkpoints for resuming or inspecting workflow state.
- The semantic distinction between derive (deterministic computation) and infer (mediated LLM judgment with declared context and capability policy) is central to the model.
- Human-facing reasoning interactions such as approvals and structured deliberations (panels) should be persisted as typed records for decision provenance and later review.
- Existing agent workflow systems focus on execution persistence (state, logs, checkpoints) but do not assign explicit semantic roles to workflow artifacts prior to execution; this model explicitly declares such roles.
- The knowledge substrate abstracts storage independently of technology, focusing on stable identity, typed roles, typed relations, and queryability across execution boundaries.
- A vocabulary and core semantic schema for workflow objects and relations is proposed, including workflow-definition, workflow-instance, inference-record, context-snapshot, approval-record, panel-record, derived-object, and dependency-link.
- Exploratory analysis of 77 real-world workflow artifacts informed vocabulary refinement, supporting the separation of approval from panel, and distinctions between active state and durable record.
Threat model
The model assumes an adversarial context where the LLM is an untrusted external judgment source; therefore, all LLM inferences (infer calls) occur under declared contexts and executor-controlled capability policies. The executor mediates all workflow transitions and tool invocations, validating and gating any LLM outputs before they can affect workflow state or external side-effects. The adversary cannot bypass executor policy or directly induce workflow transitions; the LLM's role is a peripheral, mediated oracle with no autonomous action authority.
Methodology — deep read
The paper presents a conceptual, language-independent model rather than an empirical implementation or formal specification. Its contributions are primarily architectural and representational.
Threat Model: The authors assume an executor controls workflow interpretation and externally capsulates LLM output under declared capability policies. The LLM acts as a peripheral mediator of judgment under explicit context constraints; it cannot autonomously perform transitions or effects.
Data: No datasets were used; instead, a pilot vocabulary scan of 77 heterogeneous LLM workflow artifacts (including public agent and prompt workflows, operational AI skills, and private designs) was conducted as qualitative design feedback.
Architecture: The model divides the system into three layers: semantic (workflow definitions, instances, inference and approval records as persistent knowledge objects), control (DSL machine interpreting workflow objects, managing state, mediating calls, enforcing policy), and runtime (model adapters, tools, persistence/indexing services). The knowledge substrate primitives include typed workflow objects (workflow-definition, workflow-instance), human decision records (approval-record, panel-record), computational results (derived-object, inference-record), and their typed relations (dependency-link, supersession-link).
The key semantic distinction is between derive (pure deterministic computations over workflow state) and infer (LLM-mediated judgment calls with explicit context snapshots and capability governance). Every infer call produces explicit inference records linked with context snapshots for later inspection.
Training Regime: N/A (conceptual work only).
Evaluation Protocol: A qualitative exploratory vocabulary scan was performed on collected workflow artifacts, inspecting counts of primitive usage and informing vocabulary design. Formal verification, evaluation against baselines, or user studies were deferred.
Reproducibility: No code or experimental artifacts were provided; the paper focuses on conceptual modeling. Appendices sketch primitive read/write behaviors and provide illustrative workflow examples in Lisp-inspired notation.
A concrete example workflow is partially detailed in Appendix B employing the proposed DSL forms to define, instantiate, and checkpoint workflows, illustrating derive and infer usage, approval and panel records, and the persistence of context snapshots.
Technical innovations
- Introduction of a Lisp-inspired conceptual model representing workflow definitions, running workflow instances, and LLM inference and human approval records as persistent semantic knowledge objects rather than transient execution traces.
- Definition of a semantic boundary between derive (deterministic computation) and infer (mediated LLM judgment under policy and explicit context), with inference results stored as distinct semantic objects linked to workflow state.
- Proposal to treat human-in-the-loop interactions (approvals and structured deliberations, or panels) as typed, persistent records in the workflow knowledge substrate for provenance and auditability.
- Architectural layering into semantic objects, DSL-machine control interpretation, and runtime services to separate concerns of representation, execution control, and external resource mediation.
Figures from the paper
Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.08740.
Fig 1: summarizes the three conceptual layers and the mediation boundary between semantic
Fig 2: Execution persistence retains runnable state, checkpoints, logs, traces, and outputs; semantic
Fig 3: derive computes over available state; infer requests mediated LLM judgment whose recorded
Fig 4: The executor as controller of workflow instantiation, policy checks, runtime-mediated resources,
Fig 5 (page 18).
Fig 6 (page 19).
Fig 7 (page 19).
Fig 8 (page 20).
Limitations
- The proposal is purely conceptual and lacks an implementation or empirical evaluation to validate feasibility or effectiveness.
- Formal semantics and transition rules for workflows remain future work; the current model does not rigorously specify execution or state transition behavior.
- No security or adversarial threat analysis is provided beyond design-level mediation; the derive/infer distinction is not a security guarantee.
- Vocabulary scan used a small, qualitatively selected corpus of 77 workflow artifacts which limits generalizability of design conclusions.
- No performance or scalability considerations for the semantic persistence substrate or its querying are discussed.
- The model abstracts storage technologies but does not address interoperability with existing provenance or workflow systems beyond semantic compatibility.
Open questions / follow-ons
- How can a formal transition semantics or operational semantics for this conceptual model be defined to enable formal reasoning and verification?
- How can the proposed semantic persistence layer be efficiently implemented and integrated with existing workflow systems or knowledge graphs?
- What are the practical benefits and usability implications of representing workflows and LLM interactions as persistent semantic objects for debugging, auditing, and human-in-the-loop collaboration?
- How well does the derive/infer distinction handle stochastic or mixed-initiative workflows that combine deterministic algorithms with probabilistic LLM judgments?
Why it matters for bot defense
For bot-defense and CAPTCHA practitioners, this work offers a conceptual framework for building transparent, auditable LLM-mediated workflows that can record and persist the rationale behind decisions, model inferences, and human approvals. This explicit semantic layering and persistence could improve traceability and reviewability of automated decisions involved in bot detection pipelines or CAPTCHA challenges, especially when human-in-the-loop validation is involved. The derive/infer semantic boundary may help separate deterministic rule checks from probabilistic judgments, facilitating controlled and explainable integration of LLMs within security workflows. Though abstract, adopting such models could mitigate risks of opaque, ephemeral LLM outputs impacting security decisions and enable forensic review. Careful governance via executor-mediated policies is critical to prevent manipulation or unintended side-effects in adversarial settings.
Cite
@article{arxiv2607_08740,
title={ Workflow as Knowledge: Semantic Persistence for LLM-Mediated Workflows },
author={ Emanuele Quinto and Carlo Andrea Rozzi and Francesco Zanitti },
journal={arXiv preprint arXiv:2607.08740},
year={ 2026 },
url={https://arxiv.org/abs/2607.08740}
}