February 2026

February 19, 2026

Security improvement

We've made a security improvement that performs RBAC validation prior to Data Fabric event delivery, using the exact user identity configured on any of the following trigger connections:

• Workflow automations
• Agentic processes (Maestro)
• RPA workflows
• API workflows

Data Fabric events are delivered only if the connection user has read access to:

• the target entity;
• all RBAC-protected fields in the payload.

The following table presents the impact of whether or not the required permissions are assigned to the connection user:

Scenario	Data Fabric event delivery	Workflow
The connection user has the required entity- and field-level permissions	Delivered	Executes as expected
The connection user is not assigned entity-level permissions	Not delivered	Is not triggered
The connection user is not assigned field-level permissions	Delivered with restricted fields removed from the payload before delivery	May behave unexpectedly

To ensure proper event delivery, choose one of the following options:

1. Update permissions
   1. Identify the trigger connection and its user.

   2. Assign the connection user read access to the target entity and all RBAC-protected fields referenced by the workflow.

      For more information, refer to Managing access.

2. Reconfigure connection
   1. Create a connection with a user account that has the required entity- and field-level read permissions.
   2. Update the workflow trigger to use the newly created connection.
   3. Redeploy or republish the workflow.

Note:

Before deploying to production, perform a dry run of the workflow using the Debug feature.

For RPA workflows only, you can also use the design-time Test Trigger with the intended connection identity to verify permissions before production.

For more information refer to UiPath Data Fabric events and Triggers.