Use a fixed workflow when you can write down the steps in advance, and an AI agent only when the steps depend on what turns up along the way. Workflows are easier to test and cheaper to run. Agents are more flexible, and carry more risk.
TL;DR
- Anthropic advises finding the simplest solution possible and adding complexity only when needed.
- Ask five questions: Can I list the steps? How bad is a mistake? Can I undo it? How often does the odd case happen? Who checks the result?
- Many teams end up with a workflow for the usual cases and an agent only for the odd ones.
- Whichever you pick, give it narrow tools, its own identity, and a record.
Definition box. A workflow is a set of steps and branches that people wrote in advance, with models and tools called at set points. An agent is a system where the model decides its own steps and tool use as it goes. Anthropic's engineering guide defines workflows as systems where models and tools are orchestrated through predefined code paths, and agents as systems where models dynamically direct their own processes and tool usage.
Why does this choice matter?
Because the cost of the choice shows up later. A workflow that does the wrong thing does it the same way every time, so you can find it and fix it. An agent that does the wrong thing may do it a different way each run. Anthropic says agentic systems often trade latency and cost for better task performance, and that the autonomous nature of agents means higher costs and the potential for compounding errors.
There is a safety side too. OWASP names excessive functionality, excessive permissions, and excessive autonomy as the usual roots of damaging actions. A workflow has little autonomy by design. An agent has more, so it needs more care around it.
What are the five questions?
- Can I list the steps? If yes, write a workflow. If the steps change a lot depending on what the system finds, you may need an agent.
- How bad is a mistake? A wrong summary is cheap. A wrong payment is not. The worse the mistake, the more you want fixed steps and human checks.
- Can I undo it? Drafting a reply can be undone. Sending it cannot. Prefer designs where the last step is a person's.
- How often is the case odd? If 95 out of 100 cases follow the same path, build a workflow for those. Use an agent, or a person, for the rest.
- Who checks the result? Anthropic notes agents can pause for human feedback at checkpoints or when they hit blockers. Decide in advance where the checkpoints go.
How do the two compare?
| Factor | Fixed workflow | Agent |
|---|---|---|
| Steps | Set by people in advance | Chosen by the model as it goes |
| Predictability | High | Lower |
| Cost and speed | Usually lower cost, faster | Usually higher cost, slower |
| Handles odd cases | Poorly, unless you add a branch | Better, within its tools |
| Testing | Simple, repeatable | Needs many runs and sandboxes |
| Main safety limit | Code review and tests | Narrow tools, approvals, logs, identity |
| Good for | Forms, routine reports, routing | Open ended research, multi step fixes |
A third option sits between them. You can build a mostly fixed workflow and let a model decide only one step, such as which category a message belongs to. That keeps the path predictable and still uses the model where it helps.
Worked example: scoring three tasks
The scores below are invented to show the method. Rate each factor from 1 to 5, where 5 pushes toward an agent.
| Task | Steps vary (1 to 5) | Mistake is cheap (1 to 5) | Easy to undo (1 to 5) | Odd cases common (1 to 5) | Total out of 20 |
|---|---|---|---|---|---|
| Sort incoming mail into folders | 2 | 5 | 5 | 2 | 14 |
| Refund requests | 3 | 1 | 2 | 3 | 9 |
| Research a customer before a call | 5 | 4 | 5 | 5 | 19 |
How to read it. A higher total means an agent is more reasonable. The research task scores 19. The steps differ for every customer, a mistake is cheap, and nothing needs undoing. An agent fits, as long as it only reads.
The refund task scores 9. A mistake costs money and cannot be fully undone. Build a workflow with fixed limits. If you want a model in it, use it to classify the request and let a person approve anything unusual.
The mail sorting task scores 14. It could go either way. The best answer is probably a workflow with one model step to pick the folder, since the steps do not vary much.
These scores are a thinking aid, not a measurement. The point is to talk about each factor on purpose instead of choosing the exciting option by default.
What should you do whichever way you go?
- Keep tools narrow. OWASP advises offering only the extensions that are truly needed and avoiding open ended ones such as a general shell when a purpose built tool will do.
- Give it its own identity. So you can tell its actions apart, and turn it off without breaking anything else.
- Put a person before the point of no return. The MCP tools specification says there should always be a human in the loop with the ability to deny tool invocations.
- Add stopping conditions. Anthropic notes it is common to include stopping conditions, such as a maximum number of iterations.
- Log every tool call. And review the log on a schedule.
- Test in a sandbox first. Anthropic recommends extensive testing in sandboxed environments, along with the appropriate guardrails.
You can read more about the staged approach in autonomy ladder for AI agents: promotion criteria and prompt rules versus deterministic controls for AI agents. For a list of tests to run before launch, see twelve test cases before an AI agent goes live.
Can you start with a workflow and grow into an agent?
Yes, and it is often the best path. Begin with a workflow. Watch where it fails, such as the odd cases that a person has to fix by hand. If a pattern shows up, give a small part of the job to an agent with a short list of tools and a cap on actions. Then measure. If the agent does better and the mistakes stay small, widen its job a little. If not, put the workflow back. That is slower than starting with an agent, and it is much easier to explain to a customer or an auditor.
Where does Safeguard fit?
Safeguard offers MCP Guardrail, which governs traffic between agents and MCP servers, agent identity, which tracks which agent holds what access at what level, and policies and gates that enforce rules at checkpoints. Safeguard also offers autonomous remediation with fix pull requests, which is off by default with every category set to Manual, so a person decides what goes live. The Safeguard CLI can also write code. You can try the free scan at gold.safeguard.sh/scan.
Try it yourself
Open the demo and look at the remediation strategies on offer. As you click, ask yourself where a person decides and where automation acts, and whether that split fits the risk.
Click through it at your own pace, or open it full screen.
Quick check
Is an agent always the more modern choice?
Modern is not the same as right. Anthropic advises finding the simplest solution possible and increasing complexity only when needed. For well defined tasks a workflow is more predictable and consistent.
Can a workflow use a language model?
Yes. A workflow can call a model at fixed points, such as to summarize or classify. The difference is that people set the path, not the model.
Which is safer?
A workflow, usually, because it has less autonomy and is easier to test. A well controlled agent can still be a good choice for open ended work.
Sources
Last reviewed: 19 October 2026.
