Designing Agentic Workflows That Stay Controllable

Autonomy needs a state machine

Free-form agents that invent their own plans are exciting in demos and fragile in production. Prefer an explicit workflow: gather context, propose actions, request approval when needed, execute tools, verify outcomes, and stop. The model can fill flexible steps inside that machine; it should not own the machine.

State machines make timeouts, retries, and audits possible. They also make product promises enforceable: an agent cannot refund money, delete data, or message customers unless the workflow reaches an approved state.

Tools are capabilities with contracts

Each tool should expose a narrow capability with typed inputs, authorization checks, idempotency, and clear side effects. Broad tools that can do anything through a shell or raw database invite irreversible mistakes.

Return structured results the workflow can validate. Ambiguous tool failures should not become invented successes. If a payment API times out, the agent must query status rather than assume completion.

• Require confirmation for irreversible side effects
• Bound loops with step and cost limits
• Persist plans and tool transcripts
• Prefer least-privilege credentials per tool

Keep humans in the right places

Human approval is not a confession of failure. It is a product control for actions with legal, financial, or reputational impact. Design review interfaces that show the proposed action, evidence, and alternatives in seconds, not a raw chain-of-thought dump.

Over time, promote repeatedly approved patterns into automated paths with monitoring. Controllability improves when the organization learns which decisions are safe to accelerate.

Recover like software, not like magic

Agents will stall, loop, or partially complete work. Provide compensating actions, dead-letter states, and operator tools to resume or unwind. Users should never be told the system finished when the underlying operations are unresolved.

The winning agentic systems feel calm. They use models for judgment inside carefully owned software boundaries.