What Is an Agentic Workflow?

Lathic already has articles on what agentic AI is and what an AI agent can and cannot do. This is not a third definition. It is one ordinary task, traced from instruction to finished result, with the decision points marked.

By the end you should be able to look at a tool that calls itself agentic and say what it is actually doing.

The distinction that matters

The clearest articulation comes from Anthropic's engineering team, and it is worth quoting because the whole field adopted it. Note that it is one company's framing rather than an agreed standard.

Workflows, in their words, "are systems where LLMs and tools are orchestrated through predefined code paths." Agents "are systems where LLMs dynamically direct their own processes and tool usage, maintaining control over how they accomplish tasks."

In plainer terms: in fixed automation, a person decided the steps in advance and the system executes them. In an agentic workflow, the system decides what to do next based on what it just found out.

The same guidance is unusually honest about when this is worth it. Workflows "offer predictability and consistency for well-defined tasks," agents are better "when flexibility and model-driven decision-making are needed at scale," and for many applications "optimizing single LLM calls with retrieval and in-context examples is usually enough."

Which of the two a given product is, is worth asking, and the distinction above is how you tell. Neither answer is a criticism of it.

The loop

Underneath every agentic workflow is the same small cycle, and it is documented plainly in the tooling.

OpenAI's agent framework describes it as: call the model with the current input; if it returns a final answer, stop; if it returns tool calls, run them, add the results to the conversation, and run the model again; and if it exceeds a maximum number of turns, raise an error.

That is the whole machine. Everything else is detail about what the tools are and when to stop.

One piece of this is routinely misunderstood, and Google's documentation states it outright: the model "doesn't execute the function itself." The model emits a request that a particular tool be called with particular inputs. Ordinary software runs it. The result is handed back to the model as text. The model has no hands.

Mechanically, at one developer's API, tools are supplied alongside the request as a name, a description and an input schema. When the model wants one, the response carries a stop reason indicating a tool call, along with the tool name, structured inputs and an identifier. The application runs it and returns a matching result block. Other developers use different names for the same shape.

One task, traced

Take something unglamorous: an email arrives asking whether an order shipped, and if not, when it will.

Goal. A person, or a rule, hands the system the request and a boundary: answer the customer, do not issue refunds, get approval before sending anything with a date in it.

Plan. The model reads the email and works out that it needs two things it does not have: the order status and the shipping estimate. Nobody wrote that sequence down. This is the first place an agentic workflow differs from a script.

Tool call. The model emits a request to look up the order by the reference in the email. Ordinary code runs the query.

Observation. The result comes back: the order exists, it is unshipped, and one item is on backorder. This is new information that was not available when the plan was made.

Next action. Because of the backorder, the model's original plan is wrong. It now needs a restock date, which is a different lookup. It makes a second tool call. A script would have carried on to the shipping estimate.

Loop again. Restock date returns. The model drafts a reply.

Stopping condition. It has what it needs, so it produces a final answer rather than another tool call, and the loop ends. If the second lookup had failed, it might have tried a third, and a fourth, which is why the framework also enforces a hard ceiling.

Human approval. The draft contains a date, which was the boundary set at the start, so it goes to a person before sending.

Every one of those steps exists in fixed automation too, except two: choosing to look up the restock date, and deciding it had enough to answer. Those two are the whole difference.

Where it breaks

Chaining steps introduces failure modes that a single answer does not have. These are measured.

Errors compound, and models make it worse themselves. A 2025 paper found that per-step accuracy degrades as the number of steps increases, and identified a self-conditioning effect: models "become more likely to make mistakes when the context contains their errors from prior turns." Scaling alone did not fix it. The same paper notes the encouraging corollary, that small gains in single-step accuracy compound into much longer completable tasks.

Context gets lost at handoffs. Across six generation tasks and more than 200,000 simulated conversations, one study measured an average 39% performance drop in multi-turn versus single-turn settings, and found that "when LLMs take a wrong turn in a conversation, they get lost and do not recover." That research is about conversation rather than agent handoffs specifically, but the mechanism is the same shape.

Multi-agent setups fail in patterns. Researchers at UC Berkeley annotated more than 1,600 execution traces across seven frameworks and derived a taxonomy of 14 failure modes in three groups: system design issues, misalignment between agents, and failures of task verification.

Loops do not always end. Anthropic's own write-up of its research system reports that early versions were "spawning 50 subagents for simple queries, scouring the web endlessly for nonexistent sources," and that "agents struggle to judge appropriate effort for different tasks." Frameworks ship hard step ceilings for this reason.

How reliable are these things

Two pieces of evidence, both with caveats that matter more than the headlines.

METR measures how long a task a model can complete, and reports the trend doubling on the order of every few months. As of its January 2026 update it put the leading model at a 50% time horizon of 320 minutes, with a wide confidence interval.

METR is emphatic that this is misread constantly. In its own words: "Time horizon is not the length of time AIs can work independently. Rather, it's the amount of serial human labor they can replace with a 50% success rate." Two further limits matter. The 50% is not a detail that can be tightened away, because "time horizons at 99%+ reliability levels cannot be fit at all without much larger and higher-quality benchmarks." And the figure is domain-specific: METR reports time horizons "fairly similar for math, but 40-100x lower for visual computer use tasks, due to eg poor perception."

The second is about consistency rather than capability. A benchmark of tool-using agents in retail and airline customer service found that leading function-calling agents succeeded on under half of tasks, and, more tellingly, succeeded on all eight attempts at a given task less than a quarter of the time in the retail domain. That measurement is from 2024 and names a model that is now old, so treat the number as historical and the shape as durable: an agent that sometimes works is not the same as an agent that works.

Where a person belongs

The honest answer is that it depends on what the workflow can do, and the frameworks say so.

The EU AI Act, whose high-risk obligations apply from 2 August 2027 following a 2026 amendment, requires that high-risk AI systems "be designed and developed in such a way, including with appropriate human-machine interface tools, that they can be effectively overseen by natural persons." The person overseeing must be able to monitor it, remain aware of automation bias, correctly interpret the output, decide "not to use the high-risk AI system or to otherwise disregard, override or reverse the output," and interrupt it "through a 'stop' button or a similar procedure." The Act also says oversight measures "shall be commensurate with the risks, level of autonomy and context of use."

That applies to systems the Act classifies as high risk. It is not a rule that every agentic workflow needs an approval gate, and reading it that way is the most common error in writing about this.

NIST's AI Risk Management Framework takes the same proportionate line, though it is voluntary rather than binding. It sets as an outcome that mechanisms are in place "to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use," while stating plainly that configurations "can span from fully autonomous to fully manual" and that "some AI systems may not require human oversight."

There is also a consent principle written into the tooling. The Model Context Protocol specification, the open standard for connecting models to tools, states that hosts "must obtain explicit user consent before invoking any tool," and that tool descriptions "should be considered untrusted, unless obtained from a trusted server."

The practical test: the approval gate belongs wherever an action is hard to undo. Sending, paying, publishing, deleting.

The security problem you cannot design around

An agent that reads a web page, a document or an email is reading text that someone else wrote. The model has no reliable way to tell instructions from content.

The UK's National Cyber Security Centre puts it as clearly as anyone: "Under the hood of an LLM, there's no distinction made between 'data' or 'instructions'; there is only ever 'next token'." Its conclusion is uncomfortable and worth repeating: "it's very possible that prompt injection attacks may never be totally mitigated in the way that SQL injection attacks can be."

Tools raise the stakes rather than changing the mechanism. The NCSC again: if a model can use tools and APIs, "an attacker can coerce it to use those tools/APIs," which raises the impact to "whatever the worse case scenario would be of giving an attacker direct access to those tools/APIs."

Google DeepMind states the same threat in its own terms: some tools "require access to untrusted data introducing risk," and adversaries "can embed malicious instructions in untrusted data which cause the model to deviate from the user's expectations."

The security community has an agent-specific list now. OWASP published a Top 10 for Agentic Applications in December 2025 naming goal hijack, tool misuse, identity and privilege abuse, memory and context poisoning and cascading failures among the ten.

Is "agentic" a real category

Not yet a standardized one, and it is worth knowing that.

NIST publishes a working definition on its website, describing agentic AI as systems "capable of independently making decisions, learning from interactions, and adapting to changing environments." That is an agency web page, not a NIST standard. NIST launched an AI Agent Standards Initiative in February 2026, warning that without confidence in reliability and interoperability, "innovators may face a fragmented ecosystem and stunted adoption." Standardization is starting, not finished.

The academic position is blunter. A September 2026 survey states that "the term agent in artificial intelligence lacks a standard definition, complicating the evaluation, comparison, and reproducibility of AI agent research," following a 2025 paper arguing the word "has been diluted beyond utility."

The most useful framing predates the current wave. A 2023 FAccT paper treats agency as a spectrum rather than a category, measured along how underspecified the goal is, how directly the system acts on the world, how goal-directed it is, and how far ahead it plans. The same paper makes a point worth keeping: recognizing that a system has agency "does not absolve or shift the human responsibility for algorithmic harms."

The analyst firm Gartner has a name for the marketing side, "agent washing," which it described in June 2025 as rebranding assistants, robotic process automation and chatbots without substantial agentic capability. That is a commercial analyst's estimate rather than research, and should be read as one.

What to ask about a tool that says it is agentic

If the answer to the first question is "we wrote the steps," it is automation, which may be exactly what you want.