Use a deterministic workflow when the steps and transitions are known; use an agent only when adaptive choice among bounded actions creates measurable value. Reliable AI execution persists state, limits steps and cost, makes every transition idempotent, requires approval for consequences, and can resume after crashes without replaying completed effects.
Persist workflow ID, tenant, version, current state, input references, step outcomes, attempt counts, budgets, pending approval, and timestamps. A worker claims the next eligible transition and records it atomically. Completed steps have stable effect keys.
An agent may choose which read-only diagnostic tool to call and in what order when tickets vary widely. It is not justified if a simple classifier and state machine reach the same quality more cheaply and predictably.
Bound the loop:
The application—not the model—enforces every condition.
After a crash, reload durable state and determine the next safe transition. Never infer completion only from a missing queue message. External tool effects require idempotency or reconciliation. Compensation is a domain-specific action, not magical transaction rollback.
Open-ended agency increases the space of possible failures and the difficulty of evaluation. Start with a measurable workflow, then grant flexibility only at the step where it improves outcomes. The agent maturity path is: deterministic code → model step → routed workflow → bounded agent → greater autonomy after evidence.
Model an “investigate login failure” workflow. First design it without an agent; then identify exactly one step where adaptive tool selection may improve results.
Acceptance criteria: crashes resume without duplicate effects, six-step/time/cost limits are enforced, consequential actions precede approval, and an evaluation compares workflow versus agent value.