Start with the task, then choose the autonomy.
An AI-enabled workflow follows an application-defined sequence. An agent has more freedom to choose its next step and use tools in response to what it observes. That freedom is useful when the route is uncertain, but it also makes the system harder to predict and evaluate.
If a fixed sequence reliably solves the problem, keep it. Add model-led decisions where they have a clear purpose and a measurable benefit.
Consider an invoice process. Extracting fields, checking them against an order and routing an exception can often follow a defined workflow. Investigating an unfamiliar discrepancy across several authorised systems may benefit from an agent choosing which evidence to examine next.
These are illustrative design examples, not claims about a deployed system.
Ask what the model is allowed to decide.
| Decision | Useful boundary |
|---|---|
| Which source to inspect? | Search only approved sources using the caller's permissions. |
| Which tool to call? | Use an explicit tool catalogue with validated inputs. |
| Whether to change a record? | Separate read access from write authority and require approval where appropriate. |
| When to stop? | Define time, cost, iteration and escalation limits. |
Make each added step earn its place.
More agents or more calls do not automatically improve the outcome. They can introduce coordination failures, latency and additional cost. Compare a simple baseline with the more elaborate design using the same representative tasks.
Design the tool as part of the product.
A tool needs a clear purpose, inputs that can be validated and outputs the system can interpret. Enforce its permissions in application code. Give failures a meaningful response so the workflow can retry safely or ask for help.
Never make a model's statement that it has permission the basis of authorisation. A trusted service must make that decision.
Write down the boundary before building.
- What outcome should the system produce?
- Which decisions follow fixed rules, and which need model judgement?
- What may it read, and what may it change?
- What requires a person's approval?
- Which failures stop the run, and how is recovery handled?
Choose one process you know well. Draw its fixed sequence first. Mark only the points where choosing the next step is genuinely uncertain. Those points are candidates for agentic behaviour, not an instruction to automate the whole process.
References: Anthropic: Building effective agents and OWASP: Prompt injection.
Put it into practice
Set an autonomy budget.
Choose a process you understand, such as handling an internal service request. List each step and the information needed to perform it.
- Mark which steps follow fixed rules and which require interpretation.
- For each proposed tool, write down its permissions, failure behaviour and reversibility.
- Identify the point where a person must review or approve a consequential action.
A workflow sketch that makes every model decision, tool permission and human approval visible.