---

name: workhuman-security-basics description: 'Define shared-responsibility security controls for Workhuman identity, workforce data, recognition, awards, Store, and integrations. Use when reviewing threats or hardening controls. Trigger with "secure a Workhuman integration".' argument-hint: "[tenant-or-workflow] [data-classification]" allowed-tools: Read, Glob, Grep, WebFetch, Write, Edit version: 1.4.0 author: Jeremy Longshore jeremy@intentsolutions.io license: MIT tags: [saas, workhuman, security, privacy, governance] model: inherit effort: high compatibility: Designed for Claude Code; security, privacy, SSO, privilege, retention, and integration changes require accountable owner approval

Workhuman Security and Privacy Baseline

Overview

Map customer and Workhuman responsibilities and enforce least privilege, data minimization, financial integrity, and evidence-based incident controls.

Prerequisites

• Tenant products, integrations, data flows, environments, owners, and current agreements
• Workforce-data classification, retention, residency, legal, and incident requirements
• Identity, HCM, payroll, recognition, security, privacy, and vendor contacts

Tool Discipline

Use Read, Glob, and Grep to inspect configurations and flows, WebFetch to verify current first-party commitments, and Write or Edit for threat models, control matrices, and redacted evidence.

Current Contract

Workhuman publicly states support for SSO, fraud detection, granular user privileges and grouping, encryption and monitoring practices, GDPR and CCPA compliance, ISO 27001:2022 and ISO 27701:2019 certification, and defined PCI scope. Confirm scope and customer obligations in current agreements rather than treating marketing statements as the entire control contract.

Authentication

Separate human SSO, administrator roles, managed connectors, and API principals. Enforce least privilege, tenant isolation, rotation, revocation, break-glass controls, and non-exportable secrets.

Instructions

1. Diagram identity, worker, recognition, award, redemption, payment-adjacent, reporting, and integration data flows.
2. Classify fields and define purpose, authority, access, retention, residency, export, deletion, and incident ownership.
3. Review SSO, lifecycle, privileges, groups, delegates, separation of duties, dormant access, and emergency access.
4. Threat-model spoofing, cross-tenant access, unsafe messages, approval bypass, award manipulation, fraud, replay, and data exfiltration.
5. Verify encryption, secret storage, egress allowlists, audit evidence, anomaly detection, and redacted observability at each customer-controlled boundary.
6. Reconcile program spend and sensitive administrative actions with independent evidence and named approvers.
7. Test access removal, credential rotation, rejected inputs, duplicate writes, incident containment, and recovery with synthetic fixtures.
8. Present gaps with owner, severity, compensating control, due date, verification, and rollback before changing production.

Approval Boundaries

Do not alter SSO, roles, groups, retention, exports, fraud controls, integrations, or financial workflows without security, privacy, and business-owner approval.

Output

Return the responsibility and data-flow maps, access review, threat model, control evidence, gaps, approved changes, test receipts, and residual risks.

Error Handling

Condition	Response
Agreement scope is unavailable	Mark controls unverified and request the current customer documents.
Cross-tenant or financial-integrity risk appears	Stop affected processing and activate the approved incident path.
Required data has no owner or retention rule	Block the flow until governance is assigned.

Example

A redacted completion receipt might look like this:

tenant=customer-prod; flows=7; principals=4; high-gaps=0; rotation=tested; spend-reconciliation=exact; residual-risk=accepted

Resources

• Workhuman security and privacy
• Workhuman privacy policy

Next Steps

Schedule access, data-flow, contract-scope, and recovery reviews on the customer's governance cadence.