AEM CaaS: How to Restrict Workflow Payload Path to only certain folders and its children

[bagwanpankaj]

Hi There,

I have implemented a custom workflow, however when that workflow is to be launched, it allows user to select any folder path for payload. However I would like to restrict it to a certain folder (i.e /content/xyz/ and it subfolder). I did not find any config setting for workflow model config xml that would allow us to restrict it to certain folder and its subfolder

[SantoshSai · Accepted solution]

Hi @bagwanpankaj,

If you're launching the workflow programmatically (e.g., via servlet, form, or workflow package), you can add validation logic in your custom code:

if (payloadPath.startsWith("/content/xyz/")) {
    workflowSession.startWorkflow(model, workflowData);
} else {
    throw new IllegalArgumentException("Payload must be under /content/xyz/");
}

This is the safest and most maintainable approach if you control how workflows are triggered.

If users launch the workflow manually via the UI, you can enforce the restriction at runtime by adding a custom WorkflowProcess as the first step in your workflow:

public class PayloadPathValidatorProcess implements WorkflowProcess {
    public void execute(WorkItem item, WorkflowSession session, MetaDataMap args) {
        String payloadPath = item.getWorkflowData().getPayload().toString();
        if (!payloadPath.startsWith("/content/xyz/")) {
            throw new WorkflowException("Invalid payload path: must be under /content/xyz/");
        }
    }
}

This will fail fast if someone tries to run it on an invalid path, but the workflow will still be listed and selectable.