Agentic Workflows: Definition, Core Patterns, Enterprise Examples and the Controls Regulated Teams Need

What an agentic workflow is

A traditional automation follows rules a developer wrote: if the invoice total matches the purchase order, post it; otherwise send it to a queue. A chatbot answers one question at a time and stops. An agentic workflow sits between the two. The steps and their order are mostly designed up front, but inside some steps a model reads unstructured input, decides what to do with it, picks a tool, looks at the result and decides whether it is done.

Anthropic’s December 2024 engineering post on building effective agents gives the most widely cited vocabulary. It calls systems where models and tools follow predefined code paths “workflows”, and systems where the model directs its own process and tool use “agents”. Both are agentic systems. The distinction matters in practice because the two fail differently. A workflow fails in predictable places that you can test. An agent can wander, repeat itself or take an action nobody planned for.

For a regulated business, a designed workflow with a few bounded agentic steps is usually a safer first build than a free-running agent. A claims intake process, for example, has a fixed shape (receive, classify, check coverage, request missing documents, route to an adjuster), and the model’s freedom is limited to reading the documents and choosing which branch applies. That design keeps the parts an auditor cares about predictable while still removing the manual reading.

If you want to go from definition to a working build, the step-by-step academy lesson on designing a workflow in VDF AI covers it. This article is about the patterns, examples and controls.

The seven core agentic workflow patterns

The patterns below come from Anthropic’s guidance plus two that every enterprise build adds: explicit tool use and human approval. Most real systems combine three or four of them.

Prompt chaining

Chaining is the workhorse. A supplier onboarding flow might extract company details from a registration certificate, check them against the sanctions screening tool, then draft the vendor master record. Anthropic recommends adding programmatic “gates” between steps, which in enterprise terms means validating the extracted fields before the next call uses them. Chaining trades a little latency for accuracy, because each call has a narrower job.

Routing

Routing classifies the input first and then sends it down the right path. The same idea works for models: simple requests go to a small local model, difficult ones to a larger one. In a service desk, routing separates password resets, access requests and genuine incidents so each gets its own prompt, tools and approver. Measure the classifier on its own, since a routing error silently sends work to the wrong team.

Parallelisation

Sectioning splits independent work, for example checking a marketing email for regulatory wording, brand rules and personal data in three parallel calls. Voting runs the same check several times and compares answers, which Anthropic suggests for tasks like reviewing code for vulnerabilities. Decide in advance what happens when parallel results disagree, or the human reviewer inherits the conflict without guidance.

Orchestrator-workers

Here a lead model decides the subtasks at run time. It suits work where the steps depend on what the first look reveals, such as researching a counterparty across filings, news and internal records. It is also the pattern most likely to grow costs, so it needs hard limits on the number of workers and iterations. Where several specialised agents hand work to each other, the governance questions multiply; our playbook for governing multi-agent workflows covers that case.

Evaluator-optimizer

One model writes, another grades against explicit criteria, and the loop repeats until the grade passes or a limit is hit. It works when the criteria can be written down: a style guide, a clause library, a reading-level target. Without a maximum number of rounds, the loop can run indefinitely on edge cases.

Tool use

Tools are what make a workflow act rather than talk. The Model Context Protocol has become the common way to expose those tools, and the 2026-07-28 MCP specification says there should always be a human in the loop with the ability to deny tool invocations. The OWASP Top 10 for LLM applications lists “excessive agency” as a risk with three root causes: too much functionality, too many permissions and too much autonomy. Each maps to a design decision you make when choosing which tools a step may call.

Human-in-the-loop

An approval step is a pattern in its own right, not an afterthought. It needs the proposed action, the evidence behind it and a clear accept, edit or reject choice, and it must record who decided. Anthropic’s guidance also notes that agents can pause for human feedback at checkpoints or when they are blocked, which is a useful second trigger beyond “high-risk action”. For a deeper treatment of the design choices, see the wider catalogue of agentic design patterns, which goes beyond these seven.

Agentic workflow examples from enterprise operations

The examples below are composites of common designs rather than accounts of specific customers. Each lists the patterns it uses, the systems it touches and where a person signs off.

1. Support ticket triage and reply drafting

• Patterns: routing, prompt chaining, tool use, human approval.
• Flow: classify the ticket by product and urgency, retrieve the customer’s history and the relevant knowledge base articles, draft a reply that cites them, and queue it for the support agent.
• Systems: helpdesk, CRM, knowledge base.
• Human step: the support agent edits and sends. Refunds and goodwill credits above a threshold go to a team lead.

2. AML alert case assembly

• Patterns: orchestrator-workers, tool use, human approval.
• Flow: for each alert, gather the customer profile, transaction history, prior alerts and adverse media, compare activity with the expected profile and draft a disposition rationale.
• Systems: transaction monitoring, core banking, case management, screening.
• Human step: the investigator decides to close or escalate. Narrative drafts for a suspicious activity report stay inside the bank’s confidentiality boundary.

3. Invoice exception handling

• Patterns: routing, chaining, tool use.
• Flow: when an invoice fails the three-way match, the workflow reads the invoice, purchase order and goods receipt, identifies the mismatch type (price, quantity, missing receipt) and routes it to the buyer or receiving clerk with a short explanation.
• Systems: ERP, procurement, email.
• Human step: only the approver can release payment. The workflow never edits the vendor’s bank details.

4. Contract review against a playbook

• Patterns: parallel sectioning, evaluator-optimizer, human approval.
• Flow: split the contract by clause type, compare each clause with the company’s positions and fallback language in parallel, then have an evaluator check that every deviation is flagged with a suggested redline.
• Systems: document management, clause library.
• Human step: a lawyer accepts or rejects each redline before anything goes to the counterparty.

5. IT incident investigation

• Patterns: orchestrator-workers, tool use, human approval.
• Flow: on a new incident, pull recent deploys, error logs and the matching runbook, form a hypothesis and propose a remediation command.
• Systems: monitoring, ticketing, source control, runbook wiki.
• Human step: an on-call engineer approves any change to production. Read-only diagnostics can run without approval.

6. Regulatory change monitoring

• Patterns: chaining, routing, evaluator.
• Flow: fetch new publications from regulator sites, summarise each one, map it to internal policies that may need updating and draft an impact note for the policy owner.
• Systems: regulator feeds, policy library, GRC tool.
• Human step: the compliance officer decides whether a policy change is required.

A broader set of industry examples, with banking covered in depth, is in our companion piece on agentic AI use cases by industry.

When not to make a workflow agentic

Anthropic’s advice is to find the simplest solution and add complexity only when it measurably improves the result, and it notes that many applications need nothing more than a single model call with retrieval and good examples. That is sound guidance for enterprises too. Rules-based automation is still the better choice when inputs are structured, the decision logic is stable and explainability requirements are strict. Robotic process automation still suits stable screen-level tasks; the trade-offs are covered in our comparison of agentic automation and RPA.

A short test helps. Make a step agentic only if at least one of these is true:

1. The input is unstructured (emails, PDFs, call notes) and a rule cannot reliably read it.
2. The right next step depends on content that varies case by case.
3. The task needs a judgement that a reviewer can check quickly against cited evidence.

If none apply, keep the step deterministic and let the model work only where it adds something.

The controls a regulated company needs

Supervisors have started to describe what they expect. FINRA’s 2026 Annual Regulatory Oversight Report, for example, defines AI agents as systems that can autonomously perform and complete tasks on behalf of a user. It lists risks including agents acting without human validation, exceeding the user’s intended scope and authority, and multi-step reasoning that is hard to trace. Its considerations for firms are monitoring agent system access and data handling, deciding where human-in-the-loop oversight is needed, tracking agent actions and decisions, and putting guardrails on agent behaviour (verified October 2026). Those four points translate directly into workflow design.

Two details catch teams out. First, approvals lose their value if the approver sees only “approve this action?” without the evidence, so the approval screen should show what the agent read and why it proposes the step. Second, tool descriptions are part of the control surface. Anthropic recommends writing them as carefully as documentation for a new developer and designing tools so that mistakes are hard to make; an ambiguous description is a common cause of a model calling the wrong tool.

For the governance side in more depth, the AI agent governance guide sets out roles, policies and evidence, and the human-in-the-loop lesson shows how to wire an approval step.

Building agentic workflows in VDF AI

VDF AI runs on the customer’s own servers, in a private cloud or air-gapped, with VDF AI Cloud as a hosted option. Three parts of the platform map onto the patterns above.

VDF AI Networks is the workflow canvas. Workflows are drawn as nodes joined by sequential, parallel or conditional edges, and the node types include Agent, Multi-Agent, Router, Aggregator, Tool, MCP Action, Webhook, Wait, Verification and Human Approval. That covers chaining, routing, parallel sectioning, orchestrator-workers and approval without writing orchestration code. Each saved network is versioned, so a change can be compared and rolled back. The Networks product page describes the full node set.

Agent Hub builds the agents that run inside those nodes. Tools come from an MCP tool registry that administrators govern, and tool access is granted per role, so an agent’s prompt cannot widen what it may call. The human approval request tool pauses an agent before a consequential action and records who approved it.

AI Router sends each step to the right model, local or cloud, under policies and budgets, and records every call. Combined with permission-aware retrieval over connected systems such as SharePoint, Confluence, Jira and Google Drive, it lets a workflow cite the documents it relied on while respecting the access rights of the person who started it.

Every model call, retrieval and tool invocation is written to an audit log tied to the user and role, which gives internal audit and, where relevant, EU AI Act documentation a record to work from. For the wider market of automation tools, our guide to AI workflow automation compares the approaches.

A short checklist before production

• Is each agentic step justified by unstructured input or case-by-case judgement?
• Does every tool have a clear description, a narrow scope and separate read and write variants?
• Which steps write, send or pay, and does each of them have a named approver?
• Are iteration, worker and spend limits set for every loop and orchestrator?
• Can a reviewer see the sources behind every draft?
• Is every run traceable from trigger to final action?
• Has the workflow passed a test set in a sandbox, and is there a plan to re-test after changes?