AI Agents & Automation

Workflow or agent?

A workflow follows a predefined structure. An agent can choose some of its next steps using a model and feedback from tools or its environment. The distinction matters because additional freedom creates more possible execution paths to test and govern.

Start with the simplest structure that meets the task. A fixed document-processing pipeline may need extraction, validation, and routing without an autonomous planner. An investigation assistant may benefit from choosing among several approved read-only searches.

The components of a bounded agent

• A precise objective and an explicit definition of completion.
• An approved tool set with small, well-described operations.
• Application-enforced authorization and validated arguments.
• Task state that distinguishes evidence, proposals, approvals, and completed actions.
• Limits on steps, time, retries, and cost.
• A route to a human when evidence or permission is insufficient.

Patterns that earn their complexity

Prompt chaining breaks a task into stages with checks between them. Routing selects a specialist path for a known category. Parallel work can compare independent findings. An evaluator can review an output against a defined rubric. These patterns are useful when the intermediate decisions are measurable.

A multi-agent design is not automatically more reliable. It also introduces coordination, duplicated work, inconsistent state, and new opportunities for untrusted content to spread. Keep a single owner for consequential actions and define how disagreements are resolved.

Worked example: security-alert triage

Illustrative design: an assistant receives an alert, reads approved logs, searches a runbook, and prepares a triage summary. It may propose an investigation category and the next evidence to collect. It does not disable an account or change a firewall as part of this read-only role.

If a response action is added later, separate it from investigation. Check the target resource, validate the proposed change, apply the caller’s permissions, and collect any required approval. Record the actual tool outcome instead of treating the model’s intention as successful execution.

What to evaluate

Evaluate task completion, inappropriate tool use, missing evidence, unnecessary steps, and recovery after failed tools. Replay timeouts, empty search results, conflicting documents, and malicious tool output. A useful agent knows when to stop and ask for help—not merely how to keep producing actions.

Memory also needs a purpose. Distinguish short-lived task state from durable user or organizational records, and define retention and access rules before storing sensitive information.

Sources & further reading

Primary references reviewed for this guide. Worked examples and delivery checklists are illustrative design guidance.

• Anthropic: Building effective agents
• OWASP: Excessive agency
• NIST: Generative AI profile