Page 212 - CyberSecurityEssentialsEnglish

TABLE 5-6: WHEN TO USE EACH WORKFLOW PATTERN
Pattern Use it when Do not use it when

Each step depends on the result The steps are entirely
Chaining
of the previous one. independent.

There are clear request types and The categories overlap and
Routing
paths. there is no fallback path.

The analyses can be run There are strong dependencies
Parallelization
independently. or conflicting context.

Orchestrator and The decomposition changes from
The task is fixed and simple.
workers case to case.

Evaluator and Quality can be described in a clear There is no inspectable quality
optimizer rubric. criterion.

The result is sensitive or hard to The decision is low impact and
Human approval
reverse. easily reversed.

5.4.2 From Workflow to Agent: A Ladder of Terms
Few words in this field are used as loosely as workflow and agent. The same system is
described as an assistant by one team, a workflow by another, and an agent by a vendor,

and the disagreement is rarely about the technology. It is about who decides the next step.
A short ladder settles most of the confusion.

At the first level is a plain workflow: a defined sequence that a person or a system follows,
with fixed rules and no AI at all. At the second is an AI workflow: the order of the steps is still

fixed in advance, but a model performs one or more of them, such as summarizing or
classifying. Nothing about the path changes; only the engine inside a step does.

At the third level is an AI agent. Here the system receives a goal rather than a sequence. It

decides what to do next, selects the tools it will call, observes the result, and may revise its
plan. That single difference, deciding the next step rather than executing a given one, is what
separates an agent from everything below it.

At the fourth level is an agentic workflow: an agent placed inside a real business process,

with owners, approval points, and consequences for the people the process serves. At the
fifth is an agentic system, where several agents operate together under shared governance,
with coordination, shared state, and institutional control.

The practical value of the ladder is that it tells you which controls apply. Levels one and two

need the ordinary discipline of process design covered in this chapter. Level three onwards
needs everything in Chapter Four on permissions and stopping points, and everything in

211