Autonomy
What makes a workflow agentic?
A practical boundary between deterministic automation, hybrid systems, and genuinely agentic workflows.
What makes a workflow agentic
A workflow becomes agentic when a model can choose or revise part of the path in pursuit of a goal. The trigger, permissions, available tools, success criteria, and terminal states can still be deterministic. Agentic is therefore a control choice inside a workflow—not a synonym for every multi-step LLM application.
- The model interprets context instead of only matching fixed rules
- It selects among allowed actions, tools, or specialist agents
- It observes results and can revise the next step
- The surrounding system still constrains cost, permissions, and completion
A spectrum, not a binary label
Systems range from deterministic pipelines to hybrid workflows and open-ended agents. Prompt chaining and fixed routing keep control in code. Model-based routing, dynamic planning, and tool selection add bounded autonomy. A fully autonomous loop gives the model more control over sequence and duration, increasing both flexibility and operational risk.
- Deterministic: known steps, known branches, explicit completion
- Hybrid: fixed control points with selected model-driven decisions
- Agent-led: the model plans, acts, observes, and repeats within limits
- Choose per decision; one workflow can contain all three modes
Keep the known path in code and use a model only for bounded transformations.
Start in shadow mode and expand authority only after reviewed results.
Any “no” on verification or control means redesign the boundary before adding autonomy.
The minimum working loop
A useful agentic loop needs more than a prompt. It needs an observable goal, relevant context, a deliberately small tool interface, current state, environmental feedback, verification, and a stopping rule. Without external evidence, repeated self-reflection can make an answer longer without making it more correct.
- Goal: an outcome that can be observed or tested
- Tools: bounded actions with clear schemas and error behavior
- Feedback: results from systems, tests, users, or independent checks
- Limits: time, spend, iterations, permissions, and blocked conditions
Verification and stopping conditions
The same model that produced an output should not be the only evidence that it is correct. Prefer programmatic rules, source-of-truth checks, tests, or an independently configured evaluator. Stop on verified success, a hard budget, a non-retryable failure, missing authority, or a human decision—not when the model merely says it is done.
- Define pass and fail evidence before the run starts
- Separate generation from high-impact approval
- Cap iteration even when the evaluator keeps requesting changes
- Persist enough state for a human to continue from a blocked run
Examples that justify adaptability
Coding and repository maintenance are strong examples because the required steps vary while outputs can be inspected through diffs, tests, and review. GitHub Agentic Workflows combine natural-language instructions with explicit triggers, permissions, safe outputs, isolated execution, and normal GitHub Actions runs—an instructive hybrid rather than unconstrained autonomy.
- Issue triage where categories depend on repository context
- CI failure investigation where the root cause is not known in advance
- Documentation maintenance that proposes reviewable changes
- Research tasks that choose sources but require citation checks
When not to add an agent
Do not add model-driven decisions to a stable rule, a simple data transformation, or an irreversible action that cannot be independently checked. Anthropic recommends starting with the simplest effective solution because agentic systems trade latency and cost for flexibility and can compound errors over longer runs.
- The correct path is already known and rarely changes
- A rules engine can classify the input more accurately and cheaply
- Failure is high impact and no reliable approval gate exists
- The output has no objective or human-reviewable success criterion
Guardrails belong outside the prompt
Production boundaries should be enforced by the runtime: read-only defaults, scoped credentials, isolated execution, validated outputs, approval gates, and traceable tool calls. Natural-language instructions help an agent reason, but they are not an authorization system or a reliable substitute for policy code.
- Expose only the tools and data required for the current task
- Keep secrets outside model-visible context
- Require validated channels for writes and external messages
- Log decisions, tool calls, costs, errors, and terminal state
Should this workflow be agentic?
Evaluate predictability, error cost, tool permissions, verification, and human approval before increasing autonomy.
Use the framework above as a review sequencePrimary sources
Documentation reviewed for this guide
Claims about framework behavior are tied to current first-party documentation. The design recommendations are our synthesis of those documented capabilities.
- 01AnthropicBuilding effective agents ↗
- 02
- 03
- 04MicrosoftMicrosoft Agent Framework overview ↗
- 05OpenAIOpenAI Agents SDK ↗
- 06LangChainWorkflows and agents — LangGraph ↗