{
  "experimentId": "n8n-environment-access-boundary",
  "protocolVersion": "1.0.0",
  "n8nImage": "n8nio/n8n:2.30.5",
  "n8nImageDigest": "n8nio/n8n@sha256:450853cd21a2ce36587c4c860eb26927c1ceba9496bf55f4c213b5d3a6dc8c6f",
  "runtime": {
    "platform": "darwin",
    "architecture": "arm64",
    "dockerServerVersion": "28.3.3",
    "network": "none"
  },
  "sentinel": "PUBLIC_SENTINEL_20260724",
  "startedAt": "2026-07-24T09:21:12.867Z",
  "completedAt": "2026-07-24T09:23:21.543Z",
  "workflowRuns": 40,
  "repetitionsPerCombination": 10,
  "validationFailures": [],
  "results": {
    "blocked": {
      "code_node": {
        "workflowRuns": 10,
        "executionSuccesses": 0,
        "executionFailures": 10,
        "sentinelObserved": 0,
        "environmentAccessDenied": 10,
        "cliDurationMs": {
          "min": 2915.32,
          "p50": 2963.81,
          "p95": 3801.14,
          "max": 3801.14
        }
      },
      "expression": {
        "workflowRuns": 10,
        "executionSuccesses": 0,
        "executionFailures": 10,
        "sentinelObserved": 0,
        "environmentAccessDenied": 10,
        "cliDurationMs": {
          "min": 2153.67,
          "p50": 2261.17,
          "p95": 2873.37,
          "max": 2873.37
        }
      }
    },
    "open": {
      "code_node": {
        "workflowRuns": 10,
        "executionSuccesses": 10,
        "executionFailures": 0,
        "sentinelObserved": 10,
        "environmentAccessDenied": 0,
        "cliDurationMs": {
          "min": 3029.47,
          "p50": 3251.63,
          "p95": 4054.94,
          "max": 4054.94
        }
      },
      "expression": {
        "workflowRuns": 10,
        "executionSuccesses": 10,
        "executionFailures": 0,
        "sentinelObserved": 10,
        "environmentAccessDenied": 0,
        "cliDurationMs": {
          "min": 2073.36,
          "p50": 2168.38,
          "p95": 2952.28,
          "max": 2952.28
        }
      }
    }
  },
  "conclusion": "With N8N_BLOCK_ENV_ACCESS_IN_NODE=true, both the Code node and expression workflow failed before returning the sentinel in all runs. With the flag set to false, both surfaces returned the sentinel in all runs. The setting must be treated as an instance-wide workflow data exposure boundary, not as secret storage.",
  "limitations": [
    "The experiment uses one harmless sentinel and does not place credentials or production secrets in the container environment.",
    "The result covers n8n 2.30.5 CLI executions in one Docker container per configuration mode with network disabled.",
    "The experiment does not cover external secrets integrations, credentials, custom nodes, queue workers, or per-user authorization.",
    "Explicit true and false modes are compared; the protocol does not infer the default for other n8n versions or hosting products."
  ]
}