A workflow runs a path you defined. An agent chooses its own. That buys flexibility and costs predictability, so spend it deliberately, and settle the limits while the design is still cheap to change.
Start below full autonomy
Most tasks that look agentic are better served by a fixed sequence with a model at one or two steps. Reach for a planning loop only when the sequence genuinely cannot be known in advance.
Plan for the failures
Loops fail in recognizable ways: repeating a step that never succeeds, picking a plausible wrong tool, and reporting success on partial work. Cap steps and time, make exhaustion an explicit outcome, and verify the result against the original goal rather than the agent’s own summary. A reconciliation agent that finds no match within six tool calls should stop and file an exception with its trace.
Limit access and own the decisions
Give the agent short-lived credentials scoped to the task, not a person’s standing access, and keep production secrets out of files it can read. Put a person in front of irreversible actions and anything that decides someone’s outcome. A policy says what is expected; a boundary stops it from happening, so be honest about which one you have. Log the inputs, sources, prompt and model versions, and who approved, so any decision can be reconstructed later. Give each control a named owner.
Related: Context engineering · Where AI earns its place