Key facts
- Default
- Stop. An agent is usually the wrong shape.
- Pass condition
- Observations change the next action.
- Hard stop
- Unwritten done, or writes with no approval.
- Runs where
- In the browser. Nothing is submitted.
Walk the idea through
Five gates, in order. Each stop names a cheaper shape: prompt, workflow, assisted workflow, product work, prompt chain, or human-assist. You only reach a scoped agent if every stop fails to catch you. That bias is the point.
Replay a specimen
Gate 1 of 5
The one-response gate
If the model answers once, is the job done?
Classification, extraction, rewrite, and a single Q&A are one-response jobs. “Keep going until it looks right” is not a reason to skip this gate. An agent loop does not make a one-shot task more correct; it makes it harder to test.
The known-route gate
Can you write the next action before the previous step returns?
If you can list the steps on a whiteboard without waiting for a tool result, application code should own the route. Anthropic draws this line directly: workflows orchestrate models through predefined paths; agents direct their own process. Buy only as much adaptability as the job needs.
The contract gate
Can you name success, failure, and the thing you refuse to automate?
An agent cannot invent a product decision. If the team still argues about what “done” means, a loop will produce a plausible transcript around an unmade call. Write the contract first: tools, permissions, stop conditions, and the action that stays human.
The blast-radius gate
What can a wrong tool call actually change?
A model with no tools can be wrong. A model with tools can be wrong and change the world. OWASP’s excessive-agency risk is this gap: permission that turns an ordinary model error into a customer-visible, financial, or irreversible act. Autonomy is not a substitute for an approval.
The specialist gate
Do the roles need different tools, permissions, or evaluations?
Extra agents are not a measure of seriousness. Split a system only when the contracts actually diverge: different tools, different permissions, or different eval fixtures. Two prompts sharing one toolbox are still one agent with a longer prompt.
PROMPT
Keys: 1–4 choose a door, Backspace returns, R resets. Respects reduced motion.
The five stops
The Decision Gate is fail-closed. Most useful AI features die at gate 1 or 2, and that is a successful walk. The stamps below are the vocabulary the rest of this site uses: prompt, workflow, assisted workflow, not ready, chain, human-assist, scoped, split.
An agent is the wrong shape. Single prompt or small script.
An agent is the wrong shape. Deterministic workflow.
An agent is the wrong shape. Assisted workflow.
An agent is the wrong shape. Product decision, not software.
An agent is the wrong shape. Chained prompts, no tools.
Autonomy is the wrong shape. Human-assist with a proposed action.
A scoped agent is warranted. Single agent with a written contract.
Split only for divergent contracts. Multi-agent, after a single agent fails.
Why the order is the product
Teams skip straight to “which framework” because that question is more fun than “is this even an agent.” The Gate puts the boring questions first, in the order that removes the most complexity per answer. One response kills the loop. A known route kills autonomy. An unwritten contract kills the build. An ungated write kills production. A shared toolbox kills the swarm.
Workflows are systems where LLMs and tools are orchestrated through predefined code paths.
That sentence is the known-route gate. If you can write the path, you should. Agents earn their keep only when the path cannot be written until a tool result arrives — inspect a ticket, search, draft, escalate; gather sources, notice a conflict, ask a follow-up. Even then, the blast-radius gate still applies. A research assistant with read-only search is a different object from a refund bot with a billing API.
What the specimens teach
The six specimens are teaching paths, not product recommendations. Receipt extraction dies at the one-response gate. Lead notification dies at the known-route gate. A drafted reply with a human send is an assisted workflow. “Handle onboarding” dies at the contract gate because done was never named. Angry auto-refunds die at the blast-radius gate: that is excessive agency. Support triage — inspect, search, draft, stop for a human on refunds — is the one path that warrants a scoped agent.
Replay them on the desk above. The stamp is the lesson. The readiness checker at/tools/should-this-be-an-agent remains the scored form for when the job is already close to an agent and you want a second pass. This page is the stop sign.
FAQ
Do I even need an agent or just a prompt?
Use a prompt when one model response completes the job. Use a workflow when the next action is knowable before the previous step returns. Use an agent only when tool observations change the next action, the contract is written, and side effects have an approval. The Decision Gate walks that order and stops at the first wrong shape.
How do I turn my idea into an AI agent?
Walk the idea through the Decision Gate first. If the gate stamps prompt, workflow, assisted, not-ready, chain, or human-assist, build that instead. If it stamps a scoped agent, write tools, permissions, stop conditions, and eval fixtures, then choose a framework. Idea2Agent owns that last stage; the PRD and spec belong to the sibling guides.
When is an agent the wrong shape?
An agent is the wrong shape when one response is enough, when the route is known, when success is still unwritten, when there are no tools to observe, or when write tools have no approval. Those are the five stops. Passing them is a scoped loop, not a swarm.
How is the Decision Gate different from the readiness checker?
The Gate is a fail-closed walk: one question at a time, stop at the first wrong shape, with a stamp you can copy. The readiness checker is a scored form that weighs several signals at once. Use the Gate to decide whether to build; use the checker as a second pass when the job is already close to an agent.
Sources used
- Building Effective AgentsAnthropic Engineering. Accessed 2026-07-13.
A practical distinction between augmented LLMs, workflows, and autonomous agents.
- Agents SDKOpenAI Developer Docs. Accessed 2026-07-13.
Defines agents as applications that plan, call tools, collaborate, and keep state.
- 2025 Top 10 Risk and Mitigations for LLMs and Gen AI AppsOWASP Gen AI Security Project. Accessed 2026-07-13.
Current OWASP LLM risk categories including prompt injection, sensitive data, excessive agency, and output handling.
- OWASP Top 10 for Agentic Applications for 2026OWASP Gen AI Security Project. Accessed 2026-07-13.
Agent-specific threat framework covering autonomous systems that plan, act, and make decisions across multi-step workflows.
- AI Risk Management FrameworkNIST. Accessed 2026-07-13.
NIST overview of AI RMF 1.0 and the 2024 Generative AI Profile.