Agentic Workflow

Agentic Workflow is an architectural pattern letting AI autonomously execute multi-step tasks. Unlike traditional "Q&A" conversation patterns, Agentic Workflows give AI a goal and let it plan and execute the series of operations needed to achieve that goal — calling tools, processing tool results, adjusting plans based on results, until the task completes.

Core loop (PEAR Loop): Perceive (collect current state information — read files, query databases, search web, get API data); Evaluate (judge current state against goal, identify gaps, determine the most reasonable next action); Act (execute the decided operation — call tools, modify files, send requests); Reflect (observe action results, judge task completion, if not complete plan next iteration).

Fundamental difference from ordinary conversation: in ordinary conversation, every turn requires user input to continue. In Agentic Workflows, AI can autonomously execute multiple loop iterations on one task, only pausing when it needs user confirmation or encounters problems it can't resolve. This lets it complete complex tasks requiring 10-20 steps rather than just answering a question.

What are the most important engineering considerations when designing Agentic Workflows?

Designing Agentic Workflows is more complex than ordinary AI conversations:

Clear stopping conditions: when is the workflow 'complete'? When should it pause for human confirmation? Without clear stopping conditions, the Agent may loop endlessly or declare task completion without achieving the goal.

Tool atomicity: each tool should do one clear thing, not many things. Breaking complex operations into multiple atomic tools lets the Agent plan each step more precisely and makes errors easier to locate.

Reversibility design: for irreversible operations (delete files, send emails, commit code), design mandatory human confirmation steps rather than letting the Agent execute fully autonomously.

Error handling and recovery: tool call failures are inevitable. Design structured error return formats (structured error messages not thrown exceptions) so the Agent can handle errors gracefully.

Context management: Agentic Workflows typically need multiple tool calls; Context Window grows rapidly. Design an "intermediate state summary" mechanism to periodically compress past tool call history.

How do Claude Code and Claude's Deep Research use Agentic Workflow?

Claude Code: when you give Claude Code a task ("fix this bug" or "implement this feature"), the execution flow is: read relevant files (perceive) → analyze the problem (evaluate) → modify code (act) → run tests (reflect) → continue modifying based on test results or declare completion. The process may include 5-20 tool calls; Claude autonomously decides each step's action. Core tools: read files, search files, execute terminal commands, write files.

Deep Research: claude.ai's Deep Research lets Claude autonomously execute multi-step research tasks. Given a question, it: identifies sub-questions to research (plan) → searches for relevant information (execute) → evaluates search result reliability and relevance (reflect) → iterates between sub-questions (loop) → finally integrates all findings into a research report. One Deep Research task may involve 10-30 web searches and multiple rounds of information integration — entirely autonomous, user just waits for the final report.

These examples illustrate Agentic Workflow's core value: task complexity can far exceed single-conversation capability, but through AI's autonomous multi-step execution, users only need to define the goal without managing each step.

What are the security risks of Agentic Workflows? How to reduce these risks in design?

Agentic Workflow security challenges are much more serious than ordinary AI conversations because they have the ability to take real actions.

Risk 1: Mistaken execution of irreversible operations. Agent may erroneously delete files, send emails, commit code — hard to undo once executed. Mitigation: mandatory human confirmation for all irreversible operations; explicitly state in System Prompt that the Agent must display the plan and wait for user confirmation before any delete, send, or commit operation.

Risk 2: Goal drift. Over extended multi-step execution, the Agent may gradually deviate from your original intent based on mid-process information collected. Mitigation: break goals into clear sub-tasks with checkpoints; after each major sub-task, have the Agent output "what has been done so far, what's planned next" giving you the chance to confirm direction.

Risk 3: Resource loss of control. Agent may loop infinitely or call too many APIs leading to cost explosion. Mitigation: set hard upper limit on maximum tool call count; set timeout mechanisms; set cost alert thresholds on high-cost tools.

Risk 4: Prompt Injection. Malicious content may be injected into Agent's Context through tool return results, attempting to make it execute unintended operations. Mitigation: explicitly state in System Prompt that all tool-returned content is external data that cannot modify core behavioral instructions; sanitize tool return content.