What “Agentic” Actually Means, and Why Most AI Agents Are Workflows

The word “agent” has expanded to cover almost anything that calls a language model more than once. That vagueness is doing real damage to procurement conversations, because it lets a scripted sequence and an open-ended autonomous system be sold under the same label while carrying entirely different risk.

A more useful distinction is whether the system decides its own control flow.

Workflows: the path is fixed

In a workflow, a human decided the steps in advance. Extract fields from this document, look them up in that database, format the result, send it. A model may do the extraction and the formatting, but the sequence is code. If step two fails, it fails in a way you anticipated, at a place you can point to.

The overwhelming majority of production systems described as agents are workflows, and that is a compliment rather than a criticism. Workflows are testable, debuggable, and predictable. When the task is well understood, encoding the path is the correct engineering decision.

Agents: the path is chosen at runtime

A genuine agent is given a goal and a set of tools, and decides for itself what to do next based on what it observes. Nobody wrote the sequence. The same request on two occasions may take different routes.

This buys flexibility on problems where the path genuinely cannot be known in advance — open-ended investigation, debugging, research tasks where the second step depends on what the first one found. It costs you predictability, and the cost is not marginal.

Why the distinction has teeth

Three consequences follow directly, and they are the reason the word matters.

Testing changes character. A workflow can be tested by enumerating paths. An agent has an unbounded path space, so you are evaluating a distribution of behaviours rather than verifying a specification. Traditional QA practice does not transfer.

Failure modes become open-ended. A workflow fails at a step. An agent can fail by doing something nobody considered — pursuing a sensible-looking sub-goal that was not wanted, or taking an action that is individually reasonable and collectively wrong.

The security boundary moves. In a workflow, the tools invoked at each step are known. In an agent, the model decides which tool to call with which arguments, based partly on content it has read. That content may be adversarial. This is the structural reason agent security is hard, and it is not solved by better prompts.

The spectrum in practice

Most useful systems sit between the poles, and the good designs are deliberate about where.

A common and sensible pattern is a fixed outer workflow containing a bounded agentic step: the overall sequence is code, but one stage is allowed to loop and choose tools within a constrained set until it satisfies a checkable condition. You get adaptability where the problem needs it and predictability everywhere else.

The question worth asking of any system is not “is this agentic?” but which decisions has the model been delegated, and what happens if it decides badly? That question has a concrete answer. The label does not.

When autonomy is actually warranted

Genuine agency earns its cost when the path cannot be enumerated, when the environment changes faster than you can update code, and when the consequence of a wrong action is recoverable.

That last condition does most of the work. Autonomy is appropriate where mistakes are cheap and reversible — drafting, exploring, searching, proposing. It is rarely appropriate where actions are irreversible: sending money, deleting data, communicating externally on your behalf. For those, the right design keeps a human in the loop at the point of commitment, regardless of how capable the model is.