# Workflows and agents

Workflows coordinate durable, replayable decisions. Agents choose among
bounded actions under policy and evidence. Both can run for a long time, call
tools, wait for people, and survive interruption—but they have different
determinism and trust contracts.

## Durable workflows

A workflow owns commands, event history, deterministic state transitions,
timers, signals, queries, updates, children, version markers, and terminal
outcomes. External work happens through activities or operations with explicit
effect semantics.

Replay recomputes decisions from retained history; it never repeats an
external effect merely to reconstruct state. An activity result is linked to
its intent, attempt, fence, provider acknowledgement, and any independent
postcondition evidence.

Long-running definitions evolve through explicit compatible version paths.
In-flight runs keep the behavior required to replay their histories, while
new runs can select a later revision. Unsupported histories stop with an exact
compatibility result instead of guessing.

## Human work is part of the protocol

A human task names its subject, input, permitted decision, assignee policy,
deadline, escalation, delegation, privacy, and evidence. A notification is not
approval. An approval is not execution. Expiry or revocation after approval is
checked again before the effect.

Compensation is a new action with its own semantics and authority. It does not
pretend an irreversible action never happened.

## Agents use typed operations

An agent receives an exact workspace, context policy, model/provider binding,
tool set, resource budget, and authority ceiling. Its tools are projections of
the same public read, check, test, plan, apply, and inspect operations available
to people and automation.

Model output is untrusted proposal data. It cannot mint an operation, change a
schema, widen a workspace, manufacture a grant, bypass review, or translate
possession of context into authority. A consequential tool call is validated
from its exact arguments at dispatch time.

Agent sessions retain model and tool events, approvals, context changes,
compaction boundaries, child work, cancellation, and terminal disposition.
Private reasoning need not become product data; decisions and effects retain
the smallest evidence needed for audit and replay.

## Deterministic and adaptive behavior can compose

A workflow may ask an agent for a bounded proposal, classification, or plan.
The workflow records the exact request, accepted result schema, model/provider
coordinates, policy, and evidence. Deterministic code validates the result
before it influences state or effects.

An agent may start or inspect a workflow only through a declared operation.
It does not become the workflow engine, history owner, or deployment control
plane. This separation keeps adaptive reasoning useful without making the
system's authority or recovery behavior probabilistic.

## Example

Illustrative end-product code keeps uncertain activity outcomes explicit:

```rust,ignore
match activity.await {
    Completed(value) => continue_with(value),
    OutcomeUnknown(effect) => reconcile(effect).await,
    Rejected(fault) => compensate(fault).await,
}
```

Follow [Build a durable workflow](/one/examples/durable-workflow) or
[Build a bounded agent](/one/examples/agent).

Canonical owners:
[Components](https://github.com/muijf/one/blob/main/systems/components/AGENTS.md),
[Authority](https://github.com/muijf/one/blob/main/systems/authority/AGENTS.md),
and [Developer Interface](https://github.com/muijf/one/blob/main/systems/developer-interface/AGENTS.md).

Next: [roots and composition](/one/model/composition).