A security ecosystem, device and method for distributing physical resources based on workflow interactions is provided. A computing device determines that a trigger, of a safety-workflow, has occurred, comprising: determining, from distribution-tracking data, that distribution of physical resources in a region meets a suboptimal-distribution condition. In response, the computing device implement a first responsive action, of the safety-workflow, comprising generating an indication of the distribution of the physical resources in the region at an electronic map. The computing device implements an analysis component, of the safety-workflow, comprising: determining whether the distribution of the physical resources meeting the suboptimal-distribution condition meets a predetermined exemption condition. In response to the predetermined exemption condition not being met, the computing device implements a second responsive action, of the safety workflow, comprising: providing an alert to one or more notification devices identifying that the distribution of the physical resources meets the suboptimal-distribution condition.