What is an agentic workflow?

"Agentic" has become a marketing word, which makes a plain definition worth having. This explainer describes a pattern, not any particular product, and it is editorial interpretation built on the cited sources.

What makes a workflow agentic?

Three features usually appear together: a goal rather than a single question, multiple steps that the system chooses, and tools it can use to act on the world, such as running code, searching, or editing documents.

A research paper that gave the pattern a name is ReAct (Yao and colleagues, 2022). It has a language model alternate between reasoning steps and actions, such as querying an API. The authors report that reasoning helps the model plan and recover from surprises, and that actions let it fetch information it lacks, which reduced hallucination and error propagation compared with reasoning alone.

What is the difference between a workflow and an agent?

Anthropic's December 2024 guidance, written by its own engineers, draws a useful line. It calls systems "workflows" when models and tools are orchestrated through predefined code paths, and "agents" when the model dynamically directs its own process and tool use. That is one vendor's vocabulary, not a standard, but the distinction is practical: the more the model decides, the harder the system is to predict and to test.

Most real systems sit between the two. A coding agent that follows a fixed plan-edit-test cycle but chooses its own edits is both. When a vendor says "agent", ask which decisions the model makes and which are fixed in code; see what is an AI coding agent.

Where do agentic workflows fail?

• A wrong step early on carries through later steps.
• The agent reports success when the task did not succeed.
• It takes an action you did not intend.
• It reads untrusted content that contains instructions, an attack known as prompt injection.
• It loops, retries or spends far more than the task is worth.
• It works in a test and fails in the wild because the environment differs.

OWASP, the security community behind the widely used Top 10 lists, names the underlying problem in its 2025 list for language-model applications as "excessive agency": a system taking damaging actions in response to unexpected, ambiguous or manipulated model output, triggered for instance by hallucination or prompt injection. It identifies three root causes in the table below.

OWASP adds that logging, monitoring and rate limiting help limit damage but do not prevent the problem. That is why the controls below come in a set.

What controls matter?

• Least privilege: only the access the task needs, for only as long as it needs it.
• Approval gates for consequential actions such as deleting data, sending messages, spending money or deploying.
• Logs you can review after the fact, kept somewhere the agent cannot rewrite.
• Spending and usage limits so a loop cannot run away.
• An environment boundary, such as a sandbox or a separate test account, so mistakes stay contained.

Documented examples help make this concrete. Anthropic's Claude Code documentation describes a permission system in which, by default, reading files needs no approval but running shell commands, editing files and fetching web pages do, with deny rules taking precedence over ask and allow rules, plus optional modes that relax or tighten prompting. We cite it as an example of what documented approval controls look like, not as a verdict on that product: we have not tested it.

For wider organisational practice, the NIST AI Risk Management Framework organises risk work into four functions, Govern, Map, Measure and Manage. Governance sets roles and oversight; mapping establishes context; measurement includes testing; management allocates resources and plans response and recovery. NIST's page says the framework, released in January 2023, is being revised, so check its current status.

How do agents connect to tools and data?

Connecting a model to many tools used to mean custom integrations for each. The Model Context Protocol (MCP) is an open-source standard for linking AI applications to external systems such as data sources and tools. Anthropic announced it in November 2024, and the project's documentation lists several major AI applications as supporting it. A standard connector does not make a tool safe: every connection is also a permission, which brings the controls above back into play.

How should I evaluate one?

Our guide to choosing a coding assistant applies this method to a concrete case. For deployment choices, see hosted vs. self-managed deployment; for questions to ask a vendor, the procurement evidence checklist; and for how to read the numbers vendors quote, reading benchmark claims. See also the agents category and the glossary.