Why Most AI Agents Are Workflows in Disguise

Open a pitch deck and every box is an “agent.” Open the repo and you find a state machine with an LLM drafting strings between deterministic steps. That is fine engineering. It is not agentic reasoning. The damage starts when teams staff, eval, and risk-review a workflow as if a model were choosing the path.

The agent label is easy to apply#

Workflow engines are mature: retries, timers, human tasks, audit logs. Drop an LLM node onto a BPMN-ish graph and marketing gets the word “agent” for free. Procurement hears autonomy. Security hears “maybe it will invent API calls.” Ops hears “maybe it will never stop.”

Meanwhile the graph still decides every edge. The model fills a form field. Useful? Often. Agentic? No.

A blunt test#

Ask one question in architecture review:

Who chooses the next edge?

If the next node ID is a string constant in YAML, congratulations: you built a workflow. Ship it proudly. Stop renting agent ops language.

What workflows-in-disguise look like in the wild#

Pattern A — “Refund agent.” Steps: authenticate → fetch order → LLM drafts apology → human approves → refund API. The LLM never chooses whether to refund. Finance policy does. Rename it “refund workflow with draft assist.”

Pattern B — “Research agent.” A fixed chain: search → summarize → search again → summarize → write. The second search is hardcoded. That is prompt chaining, not exploration. A real research loop would decide whether another search is warranted from the first results.

Pattern C — “Ops agent.” An orchestrator fans out three specialist prompts and merges. Specialists never refuse work or request tools outside a preset script. That is fan-out/fan-in parallel steps. Multi-agent only if each specialist can choose tools and stop under its own bounds.

Why the disguise hurts#

1. Wrong evals. Workflows need step contract tests. Agents need trajectory evals. Measuring the wrong thing greenlights the wrong failures.
2. Wrong staffing. Agent on-call implies tool abuse, loop thrash, and cost cliffs. Workflow on-call implies stuck tokens and poison messages.
3. Wrong risk narrative. Legal asks “what can it do alone?” A workflow’s honest answer is “only what the graph allows.” An agent’s answer is “anything in the allowlist within budget.” Those are different documents.
4. Wrong roadmap. Teams “add more agents” when they needed idempotent steps and better retrieval.

Agentic reasoning is narrower than people think#

Agentic reasoning means the model’s output changes control flow — which tool, whether to continue, whether to ask a human — not just the content of a field. Drafting an email inside a fixed step is language generation. Choosing to call freeze_account after reading a fraud signal is agency (and had better be bounded).

type Next =
  | { type: "workflow_edge"; to: string }      // disguise: model ignored
  | { type: "model_choice"; tool: string; args: unknown }
  | { type: "exit"; reason: "done" | "clarify" | "escalate" };

// Workflow-in-disguise: ignore model for routing
function advanceWorkflow(state: State, draft: string): State {
  return { ...state, emailDraft: draft, node: "await_human" };
}

// Actual agency: model proposes; harness validates
function advanceAgent(state: State, proposal: Next, allow: Set<string>): State {
  if (proposal.type === "exit") return exit(state, proposal.reason);
  if (proposal.type === "model_choice" && allow.has(proposal.tool)) {
    return runTool(state, proposal.tool, proposal.args);
  }
  return exit(state, "escalate"); // refuse freelancing
}

If your “agent” code path looks like advanceWorkflow, believe your eyes.

How to assess your system honestly#

Walk a real production ticket through the system with the graph open:

1. List every point where the path could change.
2. Mark who decides: code, rules, human, or model.
3. Count model-decided edges. Zero → workflow. One thin router → mostly workflow. Several tool choices under a budget → agentic slice.
4. Check whether irreversible tools can fire without a human or hard policy gate.
5. Read last week’s traces. If every run visits the same nodes in the same order, you are not watching agency. You are watching a script with stochastic text.

When a workflow should stay a workflow#

Prefer a fixed graph when:

• Regulators want an enumerable path
• Steps are known and stable for months
• Side effects are expensive and rare
• Your team’s maturity is still “LLM behind a form”

Add agentic slices only where discovery is real: unknown evidence location, branching diagnostics, research with stop-when-enough. Isolate those slices behind a router. Do not infect the whole product with a loop.

How workflows and agents should meet#

The durable pattern is boring: workflow on the outside, agent on the inside for the fuzzy mile.

Example: intake workflow classifies a case → if needs_investigation, start a bounded agent loop → when the loop exits complete or escalate, resume the workflow at the next deterministic node (notify, ticket update, human queue).

That hybrid is not a disguise. It is composition. The disguise is pretending the outer workflow is the agent.

Refactor checklist when you catch a disguise#

You do not need a rewrite to get honest:

1. Rename services and dashboards to “workflow” where the graph owns edges.
2. Move LLM nodes behind clear step contracts (schema in, schema out).
3. Keep agent runtime dependencies only on slices with model-chosen tools.
4. Split eval suites: contract tests for workflow steps; trajectory tests for agentic slices.
5. Update the risk register: enumerable paths vs allowlist-within-budget.

Teams that skip the rename keep paying agent tax — extra harness complexity, extra fear — on software that never leaves the happy path set.

One more tell: if product can draw the full flowchart on a whiteboard without saying “sometimes the model decides,” you are looking at a workflow. Draw it. Frame it. Stop apologizing for determinism; regulators often prefer it.

When disguise is intentional theatre#

Sometimes leadership demands the word “agent” for funding. Push back once with the edge test. If you still lose, quarantine the lie: keep external branding if you must, but internal runbooks, SLOs, and on-call rotations must use accurate nouns. Theatre in a customer keynote is survivable. Theatre in an incident channel is not.

Summary#

Most “AI agents” are workflows wearing a costume: fixed edges, LLM-filled blanks, agentic vocabulary. Ask who chooses the next edge. If the graph always wins, call it a workflow, eval it like a workflow, and save agentic machinery for the parts of the job that actually need model-chosen steps under budgets.