Decision flow is the path an AI system follows from input data to output or action. It includes the data sources used, the model or rules applied, any human review, and the final result. In practice, it shows how a request, document, or record is transformed into a recommendation, classification, or automated decision.
In cyber security, decision flow matters because it reveals where sensitive data enters a system, where it may be exposed, and which controls can change the outcome. Attackers may target weak points in the flow by poisoning input data, manipulating prompts, or abusing an overprivileged integration to force unsafe actions. Defenders map decision flows to spot shadow AI, verify approvals, limit data access, and prove that a system was reviewed before use. Clear decision-flow documentation also helps incident response by showing exactly what the AI saw and why it acted.