Connecting Flowable & Camunda BPMN Engines to Enterprise RAG

01. The BPMN Data Gap in Enterprise AI

In modern digital enterprises, Business Process Management (BPM) systems like Flowable and Camunda drive critical operational workflows—from loan approvals and claim settlements to complex HR onboarding and supply chain orchestration.

However, when organizations deploy Large Language Models (LLMs) and Retrieval-Augmented Generation (RAG) pipelines, BPM engines are frequently left out of the vector database index. AI agents can answer questions about static PDF policies, but they lack insight into live business process executions, active task assignments, or process definition diagrams.

To bridge this gap, OpenCrawling now natively supports the market's two leading open-source BPMN engines with specialized connector modules:

• oc-flowable-repository-connector: Connects to Flowable REST APIs (Process, CMMN, and DMN engines).
• oc-camunda-repository-connector: Connects to Camunda 7 / Camunda 8 REST & Engine APIs.

02. Architectural Overview

The Flowable and Camunda connectors leverage OpenCrawling's event-driven, decoupled Java 25 microservice architecture. When a crawl job is initiated, the connector queries the BPM engine's REST APIs using Virtual Threads and Java 25 Structured Task Scope.

Key Ingestion Targets

1. Process Definitions (BPMN 2.0 XML): Parses raw process models into structured text descriptions detailing task sequences, gateways, and service task documentation.
2. Process & Task Variables: Extracts execution state parameters (e.g., customer IDs, risk scores, request amounts) associated with running or historic process instances.
3. User Task Metadata & Forms: Indexes candidate groups, candidate users, and form field definitions.
4. Identity & Candidate Group ACLs: Synchronizes Flowable/Camunda group security rules into OpenCrawling's unified security context for zero-trust RAG filtering.

03. Configuration Example

Configuring the new BPMN connectors in OpenCrawling is straightforward via application.yml or environment variables:

# Flowable Connector Configuration
opencrawling:
  connector:
    flowable:
      enabled: true
      endpoint: "http://flowable-engine:8080/flowable-rest/service"
      username: "${FLOWABLE_ADMIN_USER}"
      password: "${FLOWABLE_ADMIN_PASSWORD}"
      scan-history: true
      include-process-variables: true
      cron: "0 */15 * * * *" # Sync every 15 minutes

# Camunda Connector Configuration
opencrawling:
  connector:
    camunda:
      enabled: true
      endpoint: "http://camunda-engine:8080/engine-rest"
      authentication: "BASIC" # BASIC, BEARER, or OAUTH2
      scan-completed-jobs: true
      batch-size: 100

04. Unified Zero-Trust Security & MCP Integration

A critical challenge when indexing business processes into vector databases is access control. A user querying an enterprise AI assistant should only receive process data they are authorized to view based on their candidate groups or tenant ID.

Both oc-flowable-repository-connector and oc-camunda-repository-connector automatically map candidate groups (e.g., group:finance-approvers, group:hr-managers) to the document's OIS Access Control List (ACL) header.

When coupled with the OpenCrawling Secure MCP Server, AI agents executing vector searches via Model Context Protocol automatically enforce identity filtering, preventing unauthorized process variable leakage.