Gnu Group Learning AcademyGnu Group ↗
AI Engineering Fundamentals · Module 07 of 12

Use workflows first, agents when they add value

Start with predictable software workflows. Then learn when model-directed decisions are useful, how tools and state are bounded, and where approvals, budgets, stop conditions and recovery are required.

Engineering focus: Workflows, tools and agentic systems

In plain English

What problem are we solving?

Start with predictable software workflows. Then learn when model-directed decisions are useful, how tools and state are bounded, and where approvals, budgets, stop conditions and recovery are required.

The rest of this module introduces the formal terminology and production controls behind that idea. You are not expected to memorize the vocabulary before using it.

Running case · Atlas Assist

Carry the same support assistant forward: approved KB, source citations, explicit insufficient-evidence fallback and one bounded read-only asset lookup. Reuse prior artifacts so each module adds evidence to one production AI system.

Learning objectives

By the end of this module, you should be able to:

  • Choose between a deterministic workflow and an agentic loop based on task uncertainty.
  • Design tool scopes, state, budgets, stop conditions and human approval points.
  • Explain how retries and non-idempotent tools can create real-world duplicate side effects.

Workflow before agent

If the steps are known, encode them directly. Agents are useful when the next step depends on interpretation, tool results or an open-ended search through a bounded action space.

Agency expands the failure surface

An agent can choose tools, iterate, accumulate state and amplify mistakes. Bound maximum steps, time, token/tool budgets, reachable tools and data domains.

State must be explicit

Separate conversation text from durable task state. Record tool requests/results, approvals and final decision so a resumed task does not depend on hidden model memory.

Idempotency matters for tools

If a tool can create a ticket, charge a card or change infrastructure, a retry must not accidentally repeat the effect. Use idempotency keys, read-before-write checks or approval gates.

Human-in-the-loop is a control, not decoration

Escalate when impact, uncertainty or policy warrants it. Human approval is most useful when the system presents the proposed action, evidence and consequences clearly enough to review.

Worked examples

Decision rule

Known sequence + bounded branching → workflow
Unknown next step + bounded tools + measurable goal → agent candidate
High-impact irreversible action → explicit approval/policy gate
  • Agentic is not synonymous with advanced.

Bounded agent loop

goal → model proposes action → validate/authorize → tool → observe result → update state
↺ until success | stop condition | budget exhausted | human escalation
  • Every loop needs an exit path.
Try it · core lab · account-free

Lab 07 — Simulate a bounded tool loop

Goal: Build a tiny deterministic agent-loop simulator with explicit budget and authorization.

Before you start

  • No paid API or cloud account is required for the core lab.
  • Core labs use Python 3 and local files only.
  • Running case: you are engineering 'Atlas Assist', an internal support assistant over a small approved knowledge base with one read-only inventory tool.
  • Carry requirements, eval cases, threat assumptions and operational evidence forward across modules instead of starting over.
STEP 1

Run bounded decisions

python3 - <<'PY2'
state={'asset':'srv-104','steps':0,'max_steps':3,'approved_tools':{'lookup_asset'}}
plan=[('lookup_asset',{'asset_id':'srv-104'}),('delete_asset',{'asset_id':'srv-104'})]
for tool,args in plan:
 state['steps']+=1
 if state['steps']>state['max_steps']: raise SystemExit('budget exceeded')
 if tool not in state['approved_tools']:
  print('DENY',tool); break
 print('ALLOW',tool,args)
assert state['steps']==2
print('PASS: tool policy stopped unsafe continuation')
PY2
STEP 2

Add an idempotency design

For a hypothetical create_ticket tool, define the idempotency key and what the executor returns if the same request is retried.

STEP 3

Define escalation

Specify when the system stops and asks a human: unsupported tool, budget exhaustion, conflicting evidence, or a write above the approved impact threshold.

Verify

  • The loop has an explicit maximum and can terminate without model cooperation.
  • Unauthorized tools are blocked by trusted code.

Expected outcome

  • A bounded workflow/agent policy with stop, idempotency and escalation rules.

Break / fix · diagnose

  • If the only stop condition is 'the model says done', add hard budgets.
  • If tool retries can repeat side effects, add idempotency before adding more autonomy.
Production view

Reliable agents look more like workflow engines with probabilistic decision points than unrestricted autonomous bots.

Local real-tool practicum · optional but recommended

Optional practicum — Ollama tool calling

Expose one read-only local function definition and inspect the model-generated tool call without executing arbitrary commands.

Prerequisites

  • Ollama installed and reachable on http://127.0.0.1:11434 for the real-tool path.

Resources created

  • Only local disposable files/processes used by the practicum.

Cost / risk

  • No cloud account required; model downloads consume disk and network bandwidth.
TOOL 1
MODEL=${MODEL:-qwen3:8b}; curl -s http://127.0.0.1:11434/api/chat -H 'Content-Type: application/json' -d "{\"model\":\"$MODEL\",\"messages\":[{\"role\":\"user\",\"content\":\"Which service owns asset srv-104?\"}],\"stream\":false,\"tools\":[{\"type\":\"function\",\"function\":{\"name\":\"lookup_asset\",\"description\":\"Read approved asset ownership\",\"parameters\":{\"type\":\"object\",\"properties\":{\"asset_id\":{\"type\":\"string\"}},\"required\":[\"asset_id\"]}}}]}" | python3 -m json.tool | head -120

Verify

  • You can inspect a structured tool proposal before any tool is executed.

Cleanup

  • Remove only the disposable files created for the lab; keep model caches only if you intend to reuse them.

Warnings

  • Do not expose shell execution, unrestricted HTTP, database admin or production write tools in a fundamentals lab.
Avoid these traps

Common mistakes

  • Using an agent for a fixed workflow.
  • Letting the model choose its own budgets or authorization.
  • Keeping critical task state only in conversation prose.
  • Retrying side-effecting tools without idempotency.
Knowledge check

Can you connect the AI behaviour to a system control?

Concept and scenario checks. Reveal the answer only after you commit to a decision.

1When is a deterministic workflow preferable?

When the steps and branches are sufficiently known and can be encoded directly.

2What must exist outside the model in an agent loop?

Hard budgets/stop conditions, tool validation/authorization and durable state/audit controls.

3Why are idempotency keys important?

Retries must not duplicate side effects such as tickets, payments or infrastructure changes.

4Scenario: an agent asks for an unapproved delete tool after one lookup. What should happen?

Trusted application policy denies the tool and the workflow stops or escalates.

My Learning

Record your progress for this module.

Progress is saved in this browser immediately. When you sign in to My Learning, it can also sync across devices.

Not started

Attempt the core lab and knowledge checks before marking the module complete.