What is Agentic Workflow?
An Agentic Workflow is a business or technical process that delegates selected runtime decisions to one or more AI agents while a trusted orchestrator enforces the allowed topology, identity, tools, state, budgets, approvals, side effects, stop conditions, and recovery rules.
Quick Facts
| Specification | Official Specification |
|---|
How It Works
An Agentic Workflow combines deterministic process control with bounded model choice. Application code decides where an agent may enter, which decisions it may make, what evidence it receives, which tools it may propose, and where control returns to a deterministic gate or human. The agent can adapt a path within that envelope; it cannot grant itself capabilities, redefine completion, or treat generated text as authorization.
The term is broader than one Agent Loop. A workflow may contain several loops, deterministic services, parallel reviews, approval waits, scheduled triggers, and compensation steps. Chain Orchestration is suitable for ordered code-defined stages; Graph Orchestration expresses explicit branches, cycles, joins, and state; an Agent is a decision-making component that may occupy one or more nodes. Multi-Agent is a topology choice, not a requirement for an agentic workflow.
Define an autonomy budget before implementation: allowed decisions, tools, resources, tenants, step and repetition limits, time, token and spend ceilings, concurrency, irreversible effects, approval thresholds, and escalation targets. Every model action is a proposal. Trusted runtime policy authorizes it using current identity and business state, then a narrow adapter executes it with minimum credentials. Tool Schema validates shape, not permission.
Persist authoritative workflow state separately from model context. Version the state schema, prompt, model, tool definitions, policy, retriever, parser, and evaluation set as one release identity. Checkpoints support replay, but external writes need stable operation keys and an effect journal. A timeout after dispatch can be outcome_unknown; reconcile the downstream system before retrying. Human approval must bind the exact actor, resource, arguments, tool and policy versions, decision, approver, and expiry.
Retrieved data, tool descriptions, tool results, messages, files, and web pages are untrusted. Separate instructions from data, limit and redact results, validate outputs, and never let a retrieved instruction expand authority. For high-impact operations, prefer draft, preview, or recommendation modes before commit, and require the source system to enforce authorization independently.
Evaluate trajectories and real outcomes, not answer style alone. Include unnecessary action, denied permission, cross-tenant resource, stale state, duplicate delivery, post-dispatch timeout, poisoned result, budget exhaustion, cancellation, crash recovery, human rejection, and no-op cases. Compare against a deterministic workflow and a human baseline. Adopt additional autonomy only when measured task success justifies the latency, cost, operational risk, and review burden.
Key Characteristics
- Selected model decisions embedded inside an application-controlled process
- Explicit autonomy budget covering capabilities, resources, time, cost, concurrency, and effects
- Versioned authoritative state separated from ephemeral model context
- Proposal, policy decision, execution, effect status, and observation kept as distinct records
- Durable checkpoints, idempotent writes, unknown-outcome reconciliation, and human escalation
- Trajectory and source-system outcome evaluation against deterministic and human baselines
Common Use Cases
- Software maintenance that explores a repository, proposes a patch, runs tests, and requests review
- Support workflows that investigate evidence and draft but do not autonomously commit high-risk changes
- Research workflows that adapt queries while preserving source provenance and stopping criteria
- Incident triage that gathers evidence, proposes remediation, and escalates privileged actions
- Document processing that routes ambiguous cases to specialized analysis or human review
- Operations where the next useful step varies but the permitted resources and outcomes are explicit
Example
Loading code...Frequently Asked Questions
How does an Agentic Workflow differ from an AI Agent?
An AI Agent is a decision-making runtime component. An Agentic Workflow is the larger process that places one or more agents among deterministic steps, tools, approval gates, state, policies, and terminal outcomes.
Is every multi-step LLM application an Agentic Workflow?
No. A fixed sequence of model calls is a chain or deterministic workflow. The workflow becomes agentic when a model is authorized to choose meaningful runtime actions or paths within an enforced envelope.
Can an Agentic Workflow safely retry tool calls?
Only when the error is classified as retryable and the operation is read-only or idempotent. For a write that timed out after dispatch, preserve the operation key, mark the outcome unknown, and reconcile before another attempt.
What should require human approval?
Approval thresholds depend on impact and reversibility. Financial transfers, deployment, account changes, external communication, destructive operations, and privilege changes usually require a preview and approval bound to the exact proposed effect.
How should an Agentic Workflow be evaluated?
Evaluate complete trajectories and source-system outcomes: task success, policy compliance, unnecessary actions, duplicate effects, recovery, stopping, latency, cost, and escalation quality. Compare with deterministic and human baselines.