Agentic Workflows
Declared Control Flow
A workflow is an execution graph declared as an artefact in its own right, separate from the reasoning of any agent inside it. The declaration might be drawn on a canvas, written as configuration, or expressed in code and deployed like any other infrastructure. That choice is an authoring preference and not the distinction that matters. What matters is that control flow stops being something the agent decides turn by turn and becomes something the system states in advance, which can then be reviewed, versioned and tested before anything runs.
Workflow Primitives
The vocabulary has converged quickly across the platforms that offer this, and the primitives below are common to all of them rather than particular to any one.
| Primitive | Kind | What It Does | Design Question It Forces |
|---|---|---|---|
| Entry point | Structure | Where execution begins, and what is already known at that moment | What state is assumed present before the first step runs |
| Step node | Node | A unit of work that reads shared state, does something, and writes state back | Whether this is genuinely one step or three that were never separated |
| Scoped step | Node | A step that overrides the model, tools, knowledge or presentation for its duration | What this step genuinely needs, and what it should be denied |
| Action node | Node | Invokes a tool or external system as a first-class step, branching on the result | What happens on the failure branch, which is the one nobody draws |
| Shared state | Data | The typed object threaded through every node, holding what has been established so far | What is in it, who may write to it, and what happens when a field is absent |
| Direct edge | Edge | Unconditional progression to the next node | Whether the sequencing is real or an accident of how it was drawn |
| Conditional edge | Edge | Routes on a deterministic check against shared state or a returned result | Whether the conditions are exhaustive, or something can fall through |
| Semantic edge | Edge | Routes on a model-evaluated judgement about intent that no expression can capture | Whether this genuinely needs judgement, or was simply easier to write in prose |
| Cycle | Edge | An edge returning to an earlier node, for retry or correction | What bounds it, since a graph with cycles is a loop wearing different notation |
| Interrupt | Control | Suspends execution pending a decision from outside the graph, then resumes | What the outside party is told on arrival, and what they are allowed to change |
| Checkpoint | Control | Persists state between steps so a run can survive a pause, a crash or a redeploy | Whether a run interrupted at step nine resumes, or restarts |
| Terminal node | Structure | Ends the run deliberately rather than by running out of edges | Whether every path actually reaches one |
The names differ far more than the ideas do. Code-first graph libraries, visual conversation canvases and enterprise multi-agent platforms have converged on the same set with different labels attached.
| Concept | What It Gets Called |
|---|---|
| Step node | A function in code-first graphs, a card on a visual canvas, a specialised agent in a multi-agent platform |
| Shared state | An explicitly typed object in code-first graphs, loosely typed variables or slots in visual tools |
| Semantic edge | Model-evaluated conditions, intent routing, or a supervisor deciding the next hop |
| Interrupt | A pause-for-approval node, an escalation step, or a handoff out of the automated path |
| Checkpoint | A checkpointer, durable execution, or session persistence |
What Varies Per Node
A subagent node is a scoped override of the base agent. Everything below can differ at a single point in the conversation, which is what makes a workflow more than a state machine drawn over one agent.
Appended to or replacing the base instructions for the duration of the node.
Why it matters: A verification step and a sales step want different personalities, and one prompt trying to be both is worse at each.
A different LLM per node, so a cheap fast model classifies and a stronger one reasons.
Why it matters: Most nodes in a real flow are routing and acknowledgement. Paying frontier prices for those is the single largest avoidable cost.
Global tools toggled off, node-specific tools added for the phase that needs them.
Why it matters: A tool the current node cannot reach is a tool that cannot be misused at this point in the conversation.
The global knowledge base disabled or supplemented with documents scoped to this step.
Why it matters: Narrow retrieval improves precision, and it is also the boundary that stops one caller's context reaching another.
How output is rendered at this stage: format, verbosity, and in a spoken system the pace and voice.
Why it matters: Reading back an account number wants different delivery from greeting someone, and users notice the seam either way.
Per-node model selection is fast and slow brain applied at the granularity of a single conversational step: a light model classifies and routes, a stronger one handles the step that actually needs reasoning. The dual-process argument stops being an architecture you build and becomes a dropdown on a node.
Routing Without Contaminating the Prompt
The best idea in the current generation is small and easy to miss. Workflow edges can carry natural-language conditions evaluated by a model, and those evaluations happen outside the active agent's system prompt, so they never influence its generation.
| Condition Type | Evaluated By | Use When | Determinism |
|---|---|---|---|
| Unconditional | Nothing. The edge always fires | Linear progression where there is genuinely no decision | Total |
| Expression | The orchestrator, over variables and structured data | Anything checkable: a verified flag, a returned status, a threshold | Total |
| Tool result | The orchestrator, on success or failure of the call | Branching after an action, especially the failure path | Total |
| LLM condition | A model, outside the active agent's prompt | Intent that cannot be expressed as an expression, such as whether the caller sounds satisfied | Probabilistic |
This is the same principle as authorisation policy: the decision is made outside the model rather than by asking the model to decide about itself. Putting routing instructions into the agent's own prompt makes the agent reason about its own control flow, which degrades both the routing and the answer.
Determinism Trade-Off
A workflow is a deliberate constraint. Scoping each subagent's tools and knowledge prevents cross-context leakage and makes behaviour predictable, at the cost of an agent that can no longer improvise its way to an answer the graph did not anticipate.
| Dimension | Autonomous Agent | Workflow |
|---|---|---|
| Control flow | Emergent. The agent decides what to do next | Declared. The graph decides, and the agent fills in a step |
| Knowledge access | Broad, avoiding silos, at the cost of precision | Deliberately narrow per node, preventing cross-context leakage |
| Unanticipated requests | Can improvise a path the designer never considered | Falls through, or needs an explicit catch-all branch |
| Auditability | Reconstructed from a trace after the fact | The graph is the specification, readable before anything runs |
| Change cost | Edit a prompt and redeploy | Edit a topology, and regression-test every path through it |
| Latency | One agent, one hop | Orchestration overhead per transition, which a spoken conversation feels immediately |
Two Families of Abstraction
Node-and-edge is not the only way to declare a workflow, and treating it as such misreads a whole class of platform. A second family declares capabilities and outcomes instead of topology, and hands routing to the runtime. Neither is the visual-versus-code distinction, which cuts across both.
| Dimension | Topology-Explicit | Capability-Composed |
|---|---|---|
| You declare | Nodes, edges and the conditions between them | Skills or capabilities, goals, and how much latitude each has |
| Routing decided by | The author, in advance and explicitly | The runtime, from the declared goal |
| The specification says | How the work should flow | What the outcome should be |
| Determinism control | Choosing deterministic edges over judged ones | A latitude setting per workflow |
| Failure appears as | An unhandled path, visible in the artefact | A routing decision you cannot inspect |
| Costs you | Every branch must be anticipated and drawn | Insight into why a given run went the way it did |
| Suits | Regulated flows, auditable ordering, fixed processes | Broad request surfaces where enumerating paths is hopeless |
The capability-composed family typically exposes a tuning control instead of edge conditions: a per-workflow dial between rigid determinism and model judgement. That is the same axis as deterministic conversation, surfaced as a setting rather than as a choice between node types. It buys enormous simplicity and costs the ability to inspect why a particular decision went the way it did.
Failure Modes
A caller says something no edge condition matches and the flow has nowhere to send them. The visual editor makes the happy path obvious and says nothing about exhaustiveness.
Fix: Require a default edge on every branching node, and test the graph for reachability and dead ends the way you would any state machine.
A transfer to another agent or a human loses what was already established, so the caller is asked to verify themselves for a second time. The most common complaint about workflow-built voice agents.
Fix: Define explicitly what travels across each transfer, and test transfers by asserting on what the receiver knows rather than that the transfer occurred.
A retry edge returns to an earlier node with no counter, so a caller who keeps failing verification cycles indefinitely. A graph with back edges is a loop, and inherits every loop failure mode.
Fix: Give every back edge an explicit budget and an escape branch. See loop control for the mechanisms.
A clean-looking graph conceals that most nodes carry substantial prompt overrides, bespoke tools and their own retrieval configuration. The picture suggests simplicity the system does not have.
Fix: Review the compiled object, not the drawing. Treat the graph as source that happens to render visually, and diff it in version control.
Scoping is applied so aggressively that a node cannot answer an adjacent question, so callers are transferred for things a broader agent would have handled in one turn.
Fix: Scope tools tightly and knowledge loosely by default. Withholding capability is a security decision; withholding information is usually just an inconvenience.
LLM-evaluated conditions route differently across otherwise identical conversations, so a flow that tested correctly behaves differently in production without anything having changed.
Fix: Prefer expression conditions wherever the signal is checkable. Log every LLM condition evaluation with its inputs so drift is visible rather than inferred.
Prior Art
Workflows are the graph layer productised, not a new discipline above it. BPMN did the same thing for workflow engines: a declared process compiled to an object a runtime executes. It came with a visual notation, and the notation is the part most people remember, which is why the visual builder now gets mistaken for the idea. It is not. A declared topology written as code and deployed as infrastructure is the same artefact with a different editor, and in production it is frequently the more maintainable one. The genuinely new parts are the ones the old notation had no concept of: a step choosing its own model, an edge condition resolved by natural-language judgement, and a step whose knowledge is deliberately narrower than the system it belongs to.
Related: The Engineering Layers for where this sits, Graph State Machine for executing a graph in code rather than drawing it, Agentic Patterns for the orchestration shapes underneath, Voice Agents and Turn-Taking for why the sub-100ms orchestration budget matters in a spoken conversation, and Authorisation Policy for scoping tools per node as a security control rather than a design convenience, and Deterministic Conversation for the scripted-utterance nodes that make regulated speech exact.