A process started in the background must not wait for a user
- Risk
- High
- Evidence
- metadata
- Section
- Flow
- Fix shape
- entity · Process
Absent, it prevents detection, investigation or response.
Decidable from the instance’s own configuration.
Whether every path through a process actually finishes.
One task per non-compliant process.
Control Statement: A process started by a signal, a timer or another background process must not contain an element that waits for a user.
Description: Pages, pre-configured pages, user dialogs and decision-by-user elements require somebody to answer them. Where the process was started in the background there is no user session to show them to, so the element waits indefinitely. This control applies through the call graph: a sub-process with an ordinary start is in scope when a background process calls it.
Rationale: The process stops, silently, holding the record. Because it is waiting rather than failing it does not appear in any error list, and the instance accumulates stalled executions that each look like work in progress. The version started by a person works perfectly, which is why this survives testing.
Audit Procedure:
- Enumerate the processes started by a signal, a timer, or a call from another process.
- Follow the call graph from each, including into sub-processes.
- Record every path that reaches an element requiring a user response.
- Check for process instances currently stalled at those elements.
Remediation:
- Remove the user-facing element from the background path.
- Where a decision is genuinely needed, make it a task assigned to somebody rather than a page waiting for nobody.
- Where one sub-process serves both a user-started and a background caller, split the two.
- Complete or cancel the instances already stalled.
Default Value: Creatio allows a user-facing element on any path regardless of how the process is started, and reports nothing when one is unreachable.
Cite this control as CIB-FLOW-002, Implementation Benchmark v0.1.0. Verified against
Creatio 8.x. Published by ctx10; not
affiliated with or endorsed by Creatio.