The choice between agents versus supervised workflows is the first architecture decision any team building with AI has to make — and it is the one most often made on vibes. Demos reward autonomy; production rewards restraint. Both Anthropic and OpenAI have now published explicit guidance on when each pattern fits, and production teams have converged on a repeatable way to choose. This guide distills that evidence.
What autonomous agents and supervised workflows actually are
In a workflow, the code decides what happens next; the model is a component called at fixed points. In an agent, the model decides — which tool to call, what to do with the result, when it is done — looping on environmental feedback until it reaches a stopping condition. Anthropic catalogs five workflow patterns: prompt chaining for fixed subtasks, routing for separable categories, parallelization for independent subtasks or confidence voting, orchestrator-workers for tasks where the subtasks cannot be predicted (coding is the canonical example), and evaluator-optimizer loops where iterative refinement pays off. If your task matches one of these, you probably do not need an agent.
The reality is a spectrum, and most production systems land in the middle: agentic workflows — “a fixed outer shape with a model choosing inside it,” as Orca Security puts it — and bounded autonomy, “tightly scoped independence within guarded perimeters.” The decision is not really agents or workflows; it is where on the autonomy dial your task belongs.
When autonomous agents are the right call
Anthropic’s fit criterion is precise: reach for agents when the problem is open-ended — where “it’s difficult or impossible to predict the required number of steps, and where you can’t hardcode a fixed path.” When the steps cannot be enumerated in advance, model-directed planning earns its keep — though even then an orchestrator-workers workflow, with a fixed outer structure that discovers subtasks dynamically, can be the right shape. Unpredictable steps favor agents or bounded hybrids; they do not decide the architecture alone, which is what the other factors are for.
OpenAI’s Practical Guide to Building AI Agents adds three qualifying signals: the task needs complex decision-making (nuanced judgment, exceptions — their example is refund approval), the existing ruleset has grown unwieldy (intricate if-then logic costly to maintain, like vendor security reviews), or the work relies heavily on unstructured data (interpreting documents, processing an insurance claim). Their gate is explicit: “Before committing to building an agent, validate that your use case can meet these criteria clearly. Otherwise, a deterministic solution may suffice.”
Two more conditions make autonomy pay off: mistakes must be cheap or reversible — drafts, summaries, briefs a human reviews — and a human can cheaply review or undo the output. Agents are ideal for “scaling tasks in trusted environments,” in Anthropic’s phrase; the emphasis belongs on trusted.
When supervised workflows win
The conservative choice is not a fallback — for most production tasks it is the right architecture. Four conditions argue for it.
High stakes. When failure is expensive — payments, legal exposure, safety, customer-facing writes — determinism is a feature. As reported in secondary incident write-ups (Atlan’s practitioner field guide; a Mansoori Technologies roundup): a coding agent executed “DROP DATABASE” on a production system despite a stated code freeze and generated some 4,000 fake accounts — presented here as those reports describe it, not as independently verified fact. An agent with production write access and no approval gate is an unreviewed deploy.
Determinism is required. Compliance and auditability demand knowing exactly what happened — which is easier to guarantee when the same input produces the same path. But reproducibility is not the same as observability: logging and trace capture must be built explicitly into either architecture. The workflow’s deterministic path simply makes the audit trail cheaper to produce and trust.
Budgets are tight. Agent loops multiply token spend and wall-clock time, and the math is unforgiving: errors compound rather than average out, so at 85% per-step accuracy — considered good — a 10-step agent workflow succeeds only about 20% of the time (0.8510), with only 24% of agent tasks succeeding on the first attempt per APEX-Agents research. Multi-agent systems add a “communication tax” of roughly two input tokens per output token, so loop costs grow superlinearly. And runaway loops are real: one reported postmortem describes a four-agent pipeline that ping-ponged for 264 hours and burned about $47,000 with no usable output — no per-agent budget ceiling, no pre-execution enforcement gate.
The task is fully specifiable. The simplest test in the guide: “If you can write the branch, write the branch. A model choosing among three known options costs more, runs slower, and gives you a worse audit trail than an if statement.” If every step can be written down, write it down in code and put the model only where judgment is actually needed.
The five decision factors for agents versus supervised workflows
Walk through each factor for your task and weigh them together — the factors interact, so no single one is a trump card. One exception: an unacceptable risk under factor 2 imposes approval and containment requirements no matter how the other factors score.
1. Task definition clarity. Can the steps be enumerated in advance? If yes — one of Anthropic’s five patterns — the workflow wins on predictability and cost. If what the system discovers along the way determines the steps, model-directed planning earns its keep — but check the shape: an orchestrator-workers workflow keeps a fixed outer structure while discovering subtasks dynamically, so unpredictable steps argue for agents or a bounded hybrid, not against all workflows.
2. Cost of failure. What does the worst mistake cost, and who pays it? Score the action, not the agent: “The same agent might summarize a contract freely and still need sign-off before emailing it to a client.” A $30 refund and a $3,000 refund are the same tool call with very different risk. Score each action on impact, reversibility, blast radius, and sensitivity — and when any one of them is unacceptable, approval and containment are required regardless of the other scores.
3. Reversibility. Can the action be undone? Read-heavy, proposal-generating tasks are forgiving; writes, sends, deploys, and payments are not. The consistent rule: start with restricted permissions, require approval for high-risk actions based on consequences and context, and allow measured, bounded autonomy for low-risk actions — widening the bounds as reliability is proven. As one practitioner guide puts it: “The first write should produce a proposal a person approves, not a change.”
4. Budget. What do token cost and latency allow per run? Prototype with the most capable model to establish a baseline, OpenAI advises, then swap in smaller models where accuracy holds — and recognize that loops can multiply model and tool costs, so measure iterations, tokens, model prices, and latency together. The documented failure mode to design against: a four-agent pipeline that looped for 264 hours and burned about $47,000 with no usable output, because nobody had set a per-agent budget ceiling or a pre-execution enforcement gate. Cost controls belong in the execution path — per-agent token budgets, spend-rate circuit breakers, synchronous pre-call gates — not in the billing dashboard.
5. Observability. How much do you need to reconstruct exactly what happened? Logging and trace capture are explicit implementation requirements for either architecture — neither gets them for free — but deterministic replay is easier to guarantee in a supervised workflow. If a regulator, a customer, or your future self will ask “why did it do that?”, weigh the workflow’s built-in reproducibility accordingly.
The hybrid middle: supervised autonomy
Almost nobody ships pure agents or pure workflows. They ship supervised autonomy — agents inside deterministic scaffolding. Four mechanisms make it work, and the major frameworks document their own versions of them: LangGraph‘s interrupts and approval breakpoints, AutoGen’s termination conditions and human-input modes, CrewAI’s task guardrails.
Approval gates. The agent proposes; a human or policy engine approves high-risk actions. LangGraph implements this with interrupts: a dynamic interrupt() that can pause a graph anywhere based on application logic, plus interrupt_before and interrupt_after breakpoints for known risky nodes. The fragment below shows the pattern — the surrounding state schema is omitted; the control structure is the point:
from langgraph.graph import StateGraph
from langgraph.checkpointing.memory import MemorySaver
graph = StateGraph(AgentState)
graph.add_node("agent", run_agent) # the model chooses tools here
graph.add_node("issue_refund", pay_customer) # irreversible action
# Pause BEFORE the refund node so every payout needs approval
workflow = graph.compile(
checkpointer=MemorySaver(), # state persists across the pause
interrupt_before=["issue_refund"],
)AutoGen takes a complementary approach with human_input_mode="TERMINATE" — the agent runs unattended and asks for sign-off at the end — plus a hard cap on consecutive turns, since unlimited auto-replies are, in one tutorial’s words, “a footgun.” Configuration fragment:
from autogen import ConversableAgent
checker = ConversableAgent(
name="reviewer",
human_input_mode="TERMINATE", # runs on its own, signs off at the end
max_consecutive_auto_reply=8, # hard cap on turns before a forced stop
llm_config={"model": "gpt-4o"},
)Bounded tool access. Read-wide, write-narrow. OWASP’s guidance for excessive agency: minimum privilege per action plus human approval before high-impact ones. One measurable threshold: tool sets above roughly 20 tools show consistent performance decline — one team improved completion rates by removing 80% of their agent’s tools.
Evals before autonomy. Measure the error rate on a fixed set before relaxing supervision. The Berkeley MAST study — 1,642 traces across seven frameworks — found 41% to 86.7% failure rates even on the systems’ own benchmarks, led by step repetition, unrecognized termination conditions, and spec disobedience. One practitioner source proposes an illustrative graduation benchmark: hold errors below 3% across 200+ actions for three consecutive weeks — a starting point requiring task-specific validation, not a general readiness standard. The gate is not an admission that the agent is not ready; it is the mechanism that generates the data to prove it is.
The graduation path. Start fully supervised; loosen the leash as measured reliability rises. One practitioner write-up describes Morgan Stanley’s DevGen.AI as starting with agents surfacing legacy-code findings for human review, then extending to autonomous changes in lower-risk modules once patterns were validated — an illustration of the pattern, not independently verified proof. A vendor-authored case study of a UK fraud-triage agent reports the same arc — shadow mode first, autonomy widened one low-risk category at a time — with the vendor’s own figures presented as illustration rather than verified outcome. The autonomy ladder — suggest only, act with approval, act and report, fully autonomous — regresses when error rates rise.
In an agentic workflow, the blast radius is no longer bounded by the code paths a developer wrote — it is bounded by the permissions granted. The permission set stops being an operational detail and becomes the design.
Common mistakes teams make
Production write access on day one. The Replit write-up above — a destructive database command executed despite a freeze instruction — is what happens when high-risk actions have no gate. Start with restricted permissions and gate high-risk actions from day one; widen the bounds only as reliability is proven.
Over-supervising into a slow, expensive chatbot. Approval on every action creates approval fatigue: “When reviewers see dozens of requests a day and nearly all of them are fine, they stop reading. Approval becomes a reflex.” Put approval gates on high-risk actions — reversible or not — and sample the rest.
Treating autonomy as binary instead of a dial. Teams leave interrupts, termination conditions, and tool scoping at defaults, then wonder why the system is reckless or useless. Autonomy should follow consequence, not category: a routine-looking calendar invite to an external executive can still warrant approval.
Skipping evals. With 44% of multi-agent failures traced to design and specification issues, most agent failures are decided before the first run. Measure on a fixed set, red-team adversarially, and define graduation criteria in writing before launch.
Confusing a great demo with production. One reported field experiment found agentic AI improved service speed but not service quality — the details come from a single secondary write-up, so read it as an illustration rather than a result. The caution stands regardless: agents change the division of labor, so measure where the value lands instead of assuming.
Worked example: two deployment decisions
Scenario A: customer support triage. An agent reads tickets, resolves the easy ones, escalates the rest. Task definition is partially clear (factor 1 leans workflow, weakly); cost of failure is high for refunds and account changes (factor 2, workflow); actions are partially reversible (factor 3, split); budget must cover thousands of tickets daily (factor 4, workflow); every customer-facing action needs an audit trail (factor 5, workflow). Verdict: supervised autonomy. One practitioner’s worked triage build lands exactly here: the workflow “resolves the easy 60 percent on its own, escalates the hard cases with a written summary, and never issues a refund without a human.” The agent owns what varies — interpreting the ticket; the rules own what must not.
Scenario B: exploratory market research. An agent researches a new segment and produces a brief. The steps cannot be enumerated in advance — favoring model-directed planning, whether as an agent or an orchestrator-workers workflow (factor 1, leans agent); the output is a document a human reads before acting (factor 2, agent); fully reversible (factor 3, agent); budget bounded by a token cap and max-iteration stop (factor 4, manageable); the brief is the deliverable, but the run’s tool calls and decisions still need logging (factor 5, neutral). Verdict: autonomous agent with human review of the final brief — open-ended, unpredictable step count, trusted environment, human review at the boundary where output enters the world.
The rubric produced different architectures for different tasks, with a reasoning trace the team can revisit — that trace is the real deliverable. When the triage agent’s error rate holds below threshold for weeks, the team has evidence to move small refunds to act-and-report; when it spikes, they tighten the gate. “Oversight generates the evidence that earns the agent more autonomy” — and the rubric is how you decide what to oversee.
The whole guide fits in one line, and it is Anthropic’s: find the simplest solution possible, and only increase complexity when it demonstrably improves outcomes. Start supervised. Measure everything. Let the data decide when the agent earns more freedom.
