Workload: Workflow Automation Agent
(Multi-step business process toward a verifiable end state — agentic only where judgment is required)
Intent
Complete a business process that spans systems — intake, enrichment, decision support, updates, notifications — ending in a verifiable Definition of Done. The agent may interpret, classify, draft, or choose among tools, but consequential state changes remain governed, idempotent where possible, and recoverable.
Anthropic distinguishes predictable workflows (orchestrated LLM calls with programmatic control) from more open-ended agents, and recommends adding agentic complexity only when simpler solutions fall short. (anthropic.com) Google similarly notes that production systems often need to interweave non-deterministic model steps with deterministic code rather than letting a model own the full execution path. (docs.cloud.google.com; github.com)
Typical requirements
- The happy path can be described as stages, even if some stages need judgment.
- Success is an end state in systems of record (ticket closed, record updated, artefact published), not a narrative claim. (anthropic.com)
- Partial failure is expected; resume/retry behaviour must be designed.
- Budgets on steps, time, and spend are mandatory.
- Ownership and audit of who/what authorised each write must be clear.
Default shape
Trigger (API, event, schedule, human)
↓
Deterministic workflow spine (orchestrator)
├── Stage N: deterministic rules OR bounded agentic step
├── Validate stage output (epistemic gate)
├── Checkpoint state
└── Continue / compensate / escalate
↓
Tool Gateway
├── Idempotent writes to systems of record
└── Policy / human authority as required
↓
Outcome verification against Definition of Done
↓
Stop (success, escalate, or controlled failure)
Default control structure: deterministic spine first, with bounded agentic steps only where classification, extraction, drafting, or tool selection needs a model. Prefer a sequential stage pipeline with gates over an unbounded free-roaming agent. Anthropic’s prompt-chaining pattern is designed for cleanly decomposable fixed subtasks with optional programmatic gates between steps. (anthropic.com) Microsoft’s sequential orchestration similarly targets step-by-step pipelines with clear dependencies. (learn.microsoft.com)
Critical design decisions
1. Deterministic spine vs agentic steps
| Option | Prefer when |
|---|---|
| Fully deterministic workflow + optional single model calls | Steps and routes are known |
| Deterministic spine + agentic stages | Some stages need judgment; order is known |
| Single free-roaming agent for the whole process | Rare; only if stages cannot be predefined and risk is low |
Default: keep orchestration deterministic. Give the model the smallest stage that needs it. Microsoft advises using the lowest complexity level that meets requirements because each step up adds coordination overhead, latency, and cost. (learn.microsoft.com) Google Research finds multi-agent topologies can degrade sequential reasoning tasks substantially under fixed compute budgets. (arxiv.org)
2. Tool writes and idempotency
| Option | Prefer when |
|---|---|
| All writes through Tool Gateway | Always |
| Idempotency keys / upsert semantics | Retries and resume are required |
| Compensating actions | Side effects cannot be made idempotent |
Default: gateway-only writes; design every write for at-least-once execution. OWASP Excess Agency mitigations require least privilege and downstream authorisation rather than trusting the model to decide whether an action is allowed. (genai.owasp.org) NCSC guidance treats tool/API blast radius as the impact envelope for prompt injection. (ncsc.gov.uk)
3. Definition of Done and verification
| Option | Prefer when |
|---|---|
| Checkable end-state predicates (API reads, row state, artefact hash) | Production automation |
| Human sign-off as DoD | High-impact or ambiguous outcomes |
| “Model says done” | Never as sole authority |
Default: DoD is evidence from systems of record (and optional human approval), collected after writes. Anthropic’s eval guidance stresses unambiguous success criteria and graders that can check environment state and tool behaviour, not only natural-language claims. (anthropic.com) ReliabilityBench similarly argues production readiness requires consistency, robustness, and fault tolerance under tool/API failures — not single-run transcript success. (arxiv.org)
4. Budgets and non-termination
| Option | Prefer when |
|---|---|
| Step / time / spend / tool-call budgets | Always |
| Checkpoint + resume | Long-running or event-driven processes |
| Escalation on budget exhaustion | Prefer over silent stop or infinite retry |
Default: hard budgets with explicit degrade/escalate behaviour; no unbounded evaluator loops without acceptance criteria. Anthropic notes evaluator–optimizer loops help only when evaluation criteria are clear and iteration demonstrably improves quality — otherwise they waste spend. (anthropic.com) Microsoft’s workflow guidance highlights checkpointing, human input, and resumable long-running processes as reasons to make the process itself explicit. (learn.microsoft.com)
AAF review focus
| Lens | Why it pressures this workload |
|---|---|
| Reliability | Partial failure, retries, compensation, verifiable end state (arxiv.org; anthropic.com) |
| Operational Excellence | Checkpoints, correlation IDs, replay, versioned workflows (learn.microsoft.com) |
| Autonomy & Outcome Governance | Which stages are agentic; where authority is granted (genai.owasp.org) |
| Security | Privileged write tools; confused deputy across systems (ncsc.gov.uk) |
| Cost | Loops, rework, and frontier models on stages that need templates (anthropic.com; arxiv.org) |
Performance (latency of serial stages) and Sustainability (wasted retries) follow. Context Optimization matters at each stage boundary — pass validated artefacts, not raw transcripts. (anthropic.com)
Dominant cross-pillar trades
No design maximises every lens. For this workload, the usual imbalances are:
- Cost × Accuracy × Speed: Stronger models and evaluator loops on judgment stages buy Accuracy; serial gates and verification reads spend Speed and Cost. A free-roaming agent can look faster on the happy path and lose Reliability/Cost under failure. (platform.openai.com; anthropic.com; arxiv.org)
- Reliability × Performance: Deterministic spine + stage gates + checkpoints buy resumability and correct end state; they add serial latency versus one unbounded loop. (learn.microsoft.com)
- Reliability × Cost: Idempotent writes, compensation, and post-write verification reads cost extra; skipping them saves spend until duplicates and rework arrive. (arxiv.org)
- Security × Autonomy: Tool Gateway + least privilege + optional HITL buy Security; they constrain Autonomy at write boundaries. (genai.owasp.org)
- Autonomy × Cost: Unbounded retries or evaluator loops without budgets trade the appearance of diligence for Cost and Sustainability blow-ups. (anthropic.com)
Typical starting bias for this workload: Reliability and Ops (verifiable DoD, checkpoints) over Autonomy and raw Speed; use cheaper/faster models on deterministic or low-risk stages and spend Accuracy budget only where judgment is required.
Common failure modes
- Agent owns the entire process with no deterministic spine. (anthropic.com; docs.cloud.google.com)
- “Done” claimed in natural language without reading back system state. (anthropic.com)
- Non-idempotent writes + retries → duplicate charges, tickets, or emails.
- No checkpointing → failures restart from scratch and duplicate side effects.
- Missing budgets → cost incidents and runaway loops.
- Handoffs between stages without schema/provenance validation. (anthropic.com)
Trade-off log
- Which stages are deterministic vs agentic, and what forced each agentic stage?
- What is the Definition of Done, and what evidence proves it?
- How do retries remain safe (idempotency, compensation)?
- What are the budgets and escalation paths on exhaustion?
- Where did we land on Cost × Accuracy × Speed, and which pillar pairs moved (e.g. Reliability↑ × Performance↓)? Why is that imbalance acceptable?
When this is not the pattern
- Conversational customer resolution as the primary interface → Customer service chatbot.
- Grounded Q&A without multi-system completion criteria → Knowledge / RAG assistant.
- Interactive assistive work inside an IDE or doc surface → Internal copilot.
Sources
- Anthropic — Building effective agents: https://www.anthropic.com/engineering/building-effective-agents
- Anthropic — Demystifying evals for AI agents: https://www.anthropic.com/engineering/demystifying-evals-for-ai-agents
- Anthropic — Effective context engineering: https://www.anthropic.com/engineering/effective-context-engineering-for-ai-agents
- Microsoft — AI agent design patterns: https://learn.microsoft.com/en-us/azure/architecture/ai-ml/guide/ai-agent-design-patterns
- Google Cloud — Choose a design pattern for agentic AI: https://docs.cloud.google.com/architecture/choose-design-pattern-agentic-ai-system
- Google ADK — Agents overview: https://github.com/google/adk-docs/blob/main/docs/agents/index.md
- Google Research — Scaling agent systems: https://arxiv.org/abs/2512.08296
- ReliabilityBench: https://arxiv.org/abs/2601.06112
- OWASP — Excessive Agency: https://genai.owasp.org/llmrisk2023-24/llm08-excessive-agency/
- UK NCSC — Prompt injection is not SQL injection: https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection
- OpenAI — Model selection: https://platform.openai.com/docs/guides/model-selection