An agentic workflow is not defined by a model call or a tool list. It is defined by the operating contract around the work: what the agent is allowed to do, what it must show, where it stops, who owns the outcome, and what evidence expands or reduces its scope. Without that contract, an agent becomes a confident extra pair of hands with no accountable place in the system.
The contract comes before autonomy
Teams often begin with the question, "What can the agent do?" The more useful question is, "What outcome can this workflow safely own today?" The answer is rarely an open-ended job title. It is a bounded task with a known input, an observable output, a user or operator who can judge it, and a clear route for exceptions.
The five-part operating contract
A compact specification for an agentic workflow before it reaches a consequential user or system.
Core idea: Scope follows a contract, not a claim of intelligence.
- Authority: actions the agent may recommend, prepare, execute, or never take
- Context: approved sources of truth, freshness expectations, and information it must not use
- Evidence: citations, confidence signals, or logged reasoning the operator needs before acting
- Escalation: the exact cases, thresholds, and people that receive uncertain or high-impact work
- Accountability: the named role responsible for workflow quality, policy, and the downstream outcome
Authority is not a slider
"Human in the loop" is too vague to operate. A human may be reviewing every action, sampling completed work, setting policy, or simply receiving an alert after the fact. Those are different systems with different risk and staffing needs. Give each action one of four explicit modes: draft, recommend, execute with approval, or execute within policy. If the team cannot name the mode, it cannot responsibly deploy the action.
- Draft: the agent produces work a human owns and edits before use
- Recommend: the agent proposes a ranked choice and shows its supporting evidence
- Execute with approval: the agent prepares a change, but a named role authorizes it
- Execute within policy: the agent acts only inside pre-defined limits with a review trail
Escalation is part of the product
The happy path is not the valuable part of an agentic system. The valuable part is what happens when facts conflict, context is missing, a decision is irreversible, or the agent is outside policy. An escalation path needs a recipient, enough context to act, a response expectation, and a way for the resolution to improve the workflow. A generic "needs review" queue is usually where accountability disappears.
Choose one bounded workflow
Start where a capable human already follows a repeatable sequence and exceptions are visible.
- Map the current decision and handoffs
- Write down failure cases before prompting
Write the operating contract
State authority, source context, evidence requirements, escalation, and the accountable role in one page.
- Review it with the workflow owner
- Remove any action the team cannot supervise yet
Earn a wider scope
Use observed quality, exception patterns, and operator feedback to decide whether the contract can expand.
- Log overrides and misses
- Change policy before increasing autonomy
Agentic systems earn trust by being legible under pressure. The operating contract is how a venture makes that legibility concrete. It preserves human judgment where it matters while allowing the system to carry more of the repetitive, evidence-backed work over time.