What is an Agentic Workflow

“We have an agent” often means a chat that never knows when to stop. Someone types a goal. The model keeps calling tools until the budget dies, or until a human closes the tab. There is no finish line. There is a conversation that looked busy.

A workflow has steps and a stop. An agentic workflow is a sequence of steps an AI can run toward a goal, with rules for when to stop — including a person who must approve before a live system changes.

Anthropic’s note on building effective agents makes the same cut: workflows with tools and stop conditions, not endless chat. The note is worth reading because it is honest about the boring parts — encoding the job, bounding the tools, and deciding what “done” means — rather than treating fluency as a process.

Older automation without models is brittle but auditable. Models without a workflow are flexible but unaccountable. An agentic workflow is the attempt to get both: language where the input is messy, and a finish line where the company needs one.

Words you’ll hear

Vendors collapse three different layers into the word “agentic”:

• Agentic capability. The model can use tools, plan, and reflect. At work, this is “it can search Drive and draft a note.” It is not yet a job.
• Agentic workflow. A designed sequence of those capabilities, with business stop conditions. This article is about this layer. At work, this is “extract, compare to the playbook, quote the CRM fields, wait for the named signer, write or refuse.”
• Agent platform. Identity, connectors, tests, and governance around many workflows. At work, this is closer to an enterprise AI operating system.

Other terms:

• Tool. An action the AI can take: search files, query CRM, post a message. At work, a tool is a hand. Hands are not roles, and they are not stop conditions.
• Stop condition. Budget hit, waiting on approval, error, empty result, human cancel. “The model says it is done” is a weak stop by itself.
• Write-back. The AI is allowed to change a live system, not just draft. See What is write-back governance.
• Human wait. A step in the sequence, not an interruption. See What is human-in-the-loop AI.
• Version. Which workflow definition ran. When policy changes, retrieval changes. Operators need to know which version ran last Tuesday.
• MCP. A common plug so AI apps can use the same tools. Plumbing. It does not define your stops. See What is Model Context Protocol.

A workstream is the company object that hosts the workflow: brief, connectors, people, budget, finish line. The workflow is the sequence. The workstream is the job folder. Mixing those two words is how demos skip isolation.

Why you should care

Capability demos look like workflows. They are not. A fluent plan is not a paused run waiting on approval, a failed run that did not retry a write, or a replay of which step ran.

It affects you if the job is multi-step, tool-using, and repeated — the opposite of one-off chat. Close checklists, renewal playbooks, and incident runbooks already have steps. Encode those. If the job is not written down, you will encode folklore and then fight the folklore.

Practical rules:

• Read-heavy workflows can be long. They should still finish in an artefact with sources.
• Write-heavy workflows should be short after the quote: one payload, one gate, one execution, one record. Do not hide ten writes in a “cleanup agent.”
• Human wait is a step, not an interruption.
• Version the workflow. Policy and retrieval drift. Last Tuesday’s run needs a definition you can still open.
• Budget is a stop. See What is AI token economics.

A mega-agent with “figure it out” as the spec is not a workflow. It is a hope.

What changes by role

Finance. Close and forecast jobs already have checklists. An agentic workflow that posts a journal without a stop at the named signer is not “agentic.” It is unattended posting. Finance also needs spend stops so a retry loop cannot become the month’s inference bill.

Legal. Customer-facing steps and anything that asserts a term need a gate before send. Air Canada’s chatbot invented a bereavement fare and the company was held to it — CBC’s report is the cautionary case for “the workflow ended at the message.” Legal also cares that the workflow version is reconstructable.

Operations. This is the native language: runbooks, queues, retries, and “do not proceed.” Ops should refuse workflows that cannot pause cleanly, cannot show which step failed, and cannot distinguish “waiting on a person” from “waiting on a tool error.”

Go-to-market. Renewal and hygiene jobs are repeated and tool-using. GTM should demand a short write path after the quote, not a weekend “cleanup” that touches hundreds of records behind one click. Time-to-approved-write is the metric, not time-to-first-plan.

Security. Tool belts are attack surface. Prompt injection that tricks a model into requesting a write should still die at a fail-closed gate. Importing every MCP helper into one workflow is how a demo becomes one actor with every production login. The OWASP Top 10 for LLM applications treats tool use as a security topic for this reason.

What people get wrong

Chat as workflow. A conversation that looks busy has no durable instance, no version, and no gate.

A checklist in a prompt. A start. Without tools, a durable job, and a stop, it is still a prompt.

Replacing a stable bot. If the job is a scheduled export, older automation is the right tool. Agentic workflows help on messy documents. They are not a prestige upgrade for a cron job.

Fully autonomous production. Only for actions you would already automate without a model, plus logging. If you would not let a scheduled job do it, do not let an agent do it unattended.

Multi-agent as a requirement. A single tool-using agent can execute a workflow. Multiple agents help when duties already split. See What is multi-agent AI.

Good looks like: named steps, bounded tools, explicit stops (including human wait and budget), versioned definitions, read-only by default, fail-closed writes. Failure looks like a flagship model with every connector and a spec that says “be helpful.”

How this shows up in Nimbus

Nimbus’s delivery unit for operators is the workstream.

The mapping in everyday terms: the brief is the goal; agent teams run the steps; connectors are the tools (default read-only); wiki is the playbook the steps must respect; governance is the wait/write stop; the Lifecycle Graph is the executed run. Model routing chooses the brain per step; it does not choose the stop.

See Workstreams, Agent teams, and Governance.

Questions people actually ask

Is a checklist in a prompt an agentic workflow?

It is a start. If there are no tools, no durable instance, and no gate, it is a prompt.

How is this different from older robotic automation?

Older automation executes deterministic steps. Agentic workflows add language and planning. That helps on messy documents. It also means you need tests and human gates. Do not replace a stable bot with an agent if the job is still a scheduled export.

Do agentic workflows require multiple agents?

No. A single tool-using agent can execute a workflow. Multiple agents help when duties already split in the organisation.

Can a workflow be fully autonomous in production?

Only for actions you would already automate without a model, plus logging.

Where do tool-connection standards fit?

A common plug so AI apps can use the same tools is plumbing. It does not define your stops or approvals. See What is Model Context Protocol.

What is a good stop condition besides “the model is done”?

Budget ceiling, empty retrieval, tool error, human cancel, and wait-for-named-signer. “Done” from the model is a suggestion. Encode the others.

How long should a write-heavy workflow be?

Short after the quote. One payload, one gate, one execution, one record. Length belongs in the read and compare steps, not in a bundle of hidden mutations.

How do we version a workflow when the wiki changes?

Treat the playbook version as an input to the run. The lifecycle graph should cite which wiki version the steps respected. Changing policy without recording which definition ran is how Tuesday becomes unexplained.

Is “agentic” the same as “autonomous”?

No. Agentic means the model can plan and use tools. Autonomy is a policy about whether a person must still sign. Most production writes should not be autonomous.

Can we import every available tool and let the model choose?

That is a confused workflow. Least privilege applies to tools as much as to data. See What is an AI workstream.

How does this relate to human-in-the-loop?

Human wait is a first-class step. If the person is only “on the loop” with a kill switch, you have a different design. See What is human-in-the-loop AI.

Will a better model remove the need for a workflow?

Stronger models plan more fluently. They still do not know your finish line, your signer, or your budget. Fluency without stops is a more expensive loop.

Related reading

What is an enterprise AI operating system and What is multi-agent AI.

Sources

• Anthropic, Building effective agents
• CBC, Air Canada chatbot lawsuit
• OWASP Top 10 for LLM applications