Workflows coordinate durable, replayable decisions. Agents choose among bounded actions under policy and evidence. Both can run for a long time, call tools, wait for people, and survive interruption—but they have different determinism and trust contracts.
Durable workflows
A workflow owns commands, event history, deterministic state transitions, timers, signals, queries, updates, children, version markers, and terminal outcomes. External work happens through activities or operations with explicit effect semantics.
Replay recomputes decisions from retained history; it never repeats an external effect merely to reconstruct state. An activity result is linked to its intent, attempt, fence, provider acknowledgement, and any independent postcondition evidence.
Long-running definitions evolve through explicit compatible version paths. In-flight runs keep the behavior required to replay their histories, while new runs can select a later revision. Unsupported histories stop with an exact compatibility result instead of guessing.
Human work is part of the protocol
A human task names its subject, input, permitted decision, assignee policy, deadline, escalation, delegation, privacy, and evidence. A notification is not approval. An approval is not execution. Expiry or revocation after approval is checked again before the effect.
Compensation is a new action with its own semantics and authority. It does not pretend an irreversible action never happened.
Agents use typed operations
An agent receives an exact workspace, context policy, model/provider binding, tool set, resource budget, and authority ceiling. Its tools are projections of the same public read, check, test, plan, apply, and inspect operations available to people and automation.
Model output is untrusted proposal data. It cannot mint an operation, change a schema, widen a workspace, manufacture a grant, bypass review, or translate possession of context into authority. A consequential tool call is validated from its exact arguments at dispatch time.
Agent sessions retain model and tool events, approvals, context changes, compaction boundaries, child work, cancellation, and terminal disposition. Private reasoning need not become product data; decisions and effects retain the smallest evidence needed for audit and replay.
Deterministic and adaptive behavior can compose
A workflow may ask an agent for a bounded proposal, classification, or plan. The workflow records the exact request, accepted result schema, model/provider coordinates, policy, and evidence. Deterministic code validates the result before it influences state or effects.
An agent may start or inspect a workflow only through a declared operation. It does not become the workflow engine, history owner, or deployment control plane. This separation keeps adaptive reasoning useful without making the system's authority or recovery behavior probabilistic.
Example
Illustrative end-product code keeps uncertain activity outcomes explicit:
match activity.await {
Completed(value) => continue_with(value),
OutcomeUnknown(effect) => reconcile(effect).await,
Rejected(fault) => compensate(fault).await,
}
Follow Build a durable workflow or Build a bounded agent.
Canonical owners: Components, Authority, and Developer Interface.
Next: roots and composition.