The newest AI models can work for hours without checking in. It’s tempting to give an agent a goal, a set of logins and a deadline, and let it get on with it. Some vendors’ demos suggest exactly that.
For most business processes, that’s the wrong design. Not because the models aren’t capable, but because capability isn’t the same as control. The better question is how much freedom each job deserves, and how to build the controls into the system rather than hoping the agent behaves.
Two ways to build an agent
An open-ended agent gets a goal and a set of tools, and decides for itself which steps to take, in what order, and when it’s finished.
An agent flow follows a defined path: a trigger, a series of steps, and approvals where they matter, with AI used at the specific steps that need judgement. Microsoft uses this exact term in Copilot Studio, where agent flows are described as deterministic: they follow a rule-based path, and the same input produces the same output. They can include AI actions, such as reading a document or calling an agent, and human-in-the-loop steps such as approvals. An agent can also call a flow as one of its tools.
The second design is less exciting in a demo. It’s also the one you can test, audit and trust with real money and real customers.
Why “let the agent decide” is riskier than it looks
Agents now run much longer. When Anthropic released Claude Opus 5.5 on 22 September 2026, one customer reported it stayed on task for over 18 hours on a large engineering task. That’s impressive, and it also means an agent can take a lot of actions before anyone looks.
A model’s promise to ask first isn’t a control. Vendors are training models to be more careful. But in September 2026 Anthropic said plainly that its Fable 5.1 model can still sometimes bypass approvals and the automated classifiers meant to check its actions. That candour is useful. If the model decides when to ask permission, sometimes it won’t. If the system requires the approval, it always happens.
The security community has noticed. When OWASP released its 2026 Top 10 for LLM applications in early September 2026, “excessive agency”, meaning AI systems with more functions, permissions or autonomy than they need, ranked third, up from sixth in its 2025 list.
Agents read things you didn’t write. An agent working through emails, documents and web pages can be steered by instructions hidden in them. We covered this in our explainer on prompt injection. The more an agent can do unsupervised, the more a successful injection can do too.
But flows for everything isn’t the answer either
It would be easy to conclude that every agent should be locked into a rigid flow. That has costs too. Rigid flows break on messy input, take longer to build, and throw away what the new models are genuinely good at: working through ambiguity, researching, drafting and recovering from small problems without help.
The useful rule is simpler. Give an agent freedom in proportion to how easily its mistakes can be caught and undone.
| The job | How much freedom |
|---|---|
| Research, summarising, drafting internal documents | Let the agent work freely, with read-only access |
| Triage, classification, extracting data from documents | An agent step inside a flow, with a fallback to a person |
| Anything that goes to a customer | A flow with a person approving, at least until it has earned trust |
| Payments, master data, deletions | A flow where fixed steps do the writing and a person approves |
| Writing code | Free to work in its own branch or sandbox, with a review gate before anything is merged and no ability to deploy |
The last row is how we run AI coding agents in our own delivery. They can draft, test and revise as much as they like. Nothing reaches a client’s systems until a person has reviewed it, and no agent can deploy a change on its own.
For choosing between a rule-based workflow and an AI step for a given task, our guide to AI agents and automated workflows has a decision table. This article is about the next question: once AI is involved, how far to let it run.
Design the flow around the agent
When an agent is part of a process that matters, a few design choices do most of the work:
- The flow owns the trigger, the permissions and the writes. The agent reads, reasons and proposes. Fixed steps carry out the change.
- Approvals are steps in the flow, enforced by the system, not instructions in a prompt.
- The agent’s access is scoped to the job. Its own identity, read-only where possible, limited to the records it needs. Our article on MCP, permissions and roles covers how.
- Every run has limits: a maximum time, a maximum number of steps and a spending cap.
- Uncertainty goes to a person. When the input doesn’t look right, or the agent signals low confidence, the flow routes it to someone rather than guessing.
- Everything is logged: what the agent saw, what it proposed, who approved it and what changed.
None of this stops you using the most capable models. It means their capability is pointed at the parts of the job where judgement helps, inside a structure that catches mistakes.
Before you give an agent more freedom
Work through these questions for each agent:
- What’s the worst action it could take with the access it has today?
- Could a person catch and undo that mistake before it causes harm?
- Which steps change records, move money or contact customers? Make those fixed steps with approval.
- Are approvals enforced by the system, or only by instructions to the agent?
- Does it have its own identity, with permissions scoped to the job?
- Are there limits on each run for time, steps and spend?
- Can you see exactly what it did, step by step, after the fact?
If the answer to question 2 is no, the agent belongs inside a flow, whatever the model’s benchmarks say.
Where to start
Pick the agent you trust least, or the process you’d most like to hand to one, and work through the seven questions. You’ll usually find a small number of steps that need firm controls, and plenty of room for the agent to work freely around them. We design agents and the flows around them as part of our AI and agents and integration and automation work. Get in touch and we’ll help you draw the line.