Field notes. John Arndt, Soxoa. Published .
If you can write the steps and exceptions in advance, start with a fixed workflow. Consider an agent when the next step depends on what it discovers, and that flexibility produces a verifiable benefit.
What decision would you delegate to the model, and what evidence would show it made that decision usefully? Answer that before connecting business systems. Name the person accountable for the process.
The difference is who chooses the next step
In a fixed workflow, software follows predefined paths: validate, check a condition, route, wait for approval, update a record. It can include AI classification or drafting. The surrounding route and action rules remain defined in code. The AI output can still vary.
An agent uses a model to choose steps or tools as the task develops. It might inspect a record, decide another source is needed, retrieve it, and revise its approach. Anthropic's engineering guide makes this architectural distinction between predefined workflows and model-directed agents. It also recommends starting with the simplest suitable approach and adding complexity when it earns its place.
A fixed process can pass an investigation to a bounded agent, then require approval before acting on its findings. Our general explanation of AI agents covers the terminology.
Four questions to choose the design
Write the answers with the person who does the work and the person accountable for its outcome.
- Can we specify the route?
- If the inputs, branches, and actions are known, use a fixed workflow as the comparison baseline. Variable wording alone may need extraction or classification inside that route. Investigate an agent when the required steps genuinely vary with the evidence.
- Can we verify progress?
- An agent needs observable results from its tools and a defined finishing condition. Finding a source or confirming a record's state can be checked. A polished explanation that the task is complete is insufficient evidence that an action happened.
- What does an error cost?
- Separate an incorrect draft from an unauthorized commitment. Restrict consequential actions and define a reviewer. If useful performance depends on giving the model authority your organization cannot accept, narrow the task.
- Does flexibility repay its burden?
- Compare completed work, reviewer corrections, waiting, usage, and maintenance. Additional paths create more behavior to inspect. A system that takes longer to supervise may lose to a simple workflow.
Two illustrative assignments
An equipment request is a fixed-workflow candidate: collect required fields, check the approved catalog, route to the budget owner, create an IT task after approval, and report status. Missing approval stops the process. AI might help interpret free text, while explicit rules control routing and task creation.
Investigating a delayed shipment may justify a bounded agent. Depending on what it finds, it could inspect approved order history, retrieve tracking events, compare a delivery exception with warehouse notes, and prepare an evidence-backed summary. The next source depends on earlier findings. A service lead reviews the summary and decides what to tell the customer.
Start with read access and draft output. Refunds, replacements, customer messages, and promises about delivery remain separate authorized actions. The investigator does not need authority to resolve every consequence.
Separate reasoning from permission
OWASP's Excessive Agency guidance identifies excessive functionality, permissions, and autonomy as sources of risk. It recommends limiting tools and privileges and enforcing authorization in the systems that execute actions. A prompt asking the model to be careful is not that enforcement.
Give the investigator only the approved sources and operations. Use the requester's actual access scope where appropriate. If a later design permits an action, validate its target, parameters, and approval outside the model. Approval to investigate one order must not become permission to search every customer's records.
Deployment is a separate decision. A local agent can still have excessive authority; a hosted agent can still have narrowly scoped permissions. Our private AI approach addresses processing locations and data boundaries alongside access and review.
Design retries and escalation before launch
Suppose creating an IT task times out. The request may have succeeded even though the workflow never received confirmation. A blind retry could create a duplicate. Make permitted actions replay-safe where the receiving system supports it: reuse a stable request identifier, check the resulting state, and record the outcome. Engineers call this idempotency; the business requirement is that retrying the same request does not create a second commitment.
Set limits on attempts, elapsed time, and tool use. Distinguish temporary unavailability from a denied permission or missing approval. Those last two require a stop or escalation, not repeated attempts. Send a named person the evidence collected, unresolved question, actions attempted, and current state so they can continue without starting over.
Compare both options on an acceptance record
Run the eligible designs on the same approved cases. Agree these example checks before testing; preserve failures as well as successful demonstrations.
- Ordinary and unusual work
- Include complete requests, missing data, contradictory records, and a genuinely unresolved case. Check whether the result and escalation match the workflow owner's expectations.
- Authority boundaries
- Try a request outside the user's access and source content that asks for an unauthorized action. Confirm that the executing system rejects it and that no hidden side effect occurs.
- Interrupted actions
- Simulate a timeout after an action reaches the receiving system. Check the final record, duplicate prevention, retry limits, and reviewer visibility into uncertain outcomes.
- Useful operation
- Measure the whole task, including human review and corrections. Confirm that another authorized operator can inspect the record, stop the run, and resume the documented manual path.
Scope the smallest useful delegation
The decision may be a fixed workflow, an agent inside one bounded step, or a stop while the process is clarified. Keep the reason and acceptance evidence with the design. Reassess when tools, permissions, models, or business rules change.
Our agentic AI implementation page explains the scoping approach. An AI Build Sprint can include the comparison, review path, and operating handoff. Before choosing a builder, ask to see the AI evaluations and how their results changed the proposed design.
Common questions
- Does workflow automation need an AI agent?
- No. Defined steps can use ordinary automation. AI classification or drafting can sit inside that workflow while code controls the overall process.
- When is agentic AI worth testing?
- When the next steps depend on evidence discovered during the task, progress can be verified, authority can be bounded, and a pilot can compare its benefit with a simpler approach.
- Can an AI agent operate with human approval?
- Yes. It can gather evidence and propose an action while a separate control requires the designated person's approval before execution. Test the missing, refused, expired, and changed-approval cases.