Key takeaways
- Deterministic means the same valid input follows the same coded path. Agentic means a model can choose the path from the goal and what it observes.
- Choose at the step level, not once for the whole process. A durable workflow usually contains deterministic code, bounded model judgment and human gates.
- Spend variance where it buys coverage of cases you cannot enumerate. Do not spend it on arithmetic, permissions, thresholds, record updates or final commitments.
- Every agentic step needs a budget: allowed tools, maximum turns, time or cost ceiling, checked output and a named fallback.
- If you cannot state how an agentic step is evaluated, keep it in observation mode. Flexibility without a pass condition cannot improve safely.
Deterministic, model-assisted and agentic are three levels
Teams often put every model call in the agentic bucket. That hides the decision that matters. A fixed workflow can ask a model to classify one message, validate the result against six allowed labels and then return to code. The output may vary, but the path does not. An agent goes further: the model chooses which tool or subtask comes next and may repeat the loop until it judges the goal complete.
Anthropic's production guidance makes the same distinction between predefined workflows and agents that direct their own process. It recommends simple, composable patterns before autonomous ones and notes the latency, cost and compounding-error tradeoff. The source is a model vendor; this page uses its architectural definitions, not its product performance claims.
| Level | What may vary | Good use | Pass condition |
|---|---|---|---|
| Deterministic code | Values and branches already allowed by the program. | Arithmetic, thresholds, lookups, permissions and record writes. | Exact expected state for a known input. |
| Bounded model judgment | One interpretation or draft inside a fixed step. | Classification, extraction or drafting from messy input. | Schema, allowed labels, factual checks and sampled review. |
| Agentic loop | The number, order and choice of allowed actions. | Investigation or repair where the useful path emerges from evidence. | Goal rubric, safety checks, budgets and a stop reason. |
| Human decision | A judgment made by the named accountable person. | Commitments, high-impact exceptions and policy changes. | Recorded approval, reason and authority. |
Build a variance budget for every step
Variance is not automatically a defect. It is what lets a system handle a complaint written in a way nobody anticipated or search for evidence across an unfamiliar case. The question is whether different behaviour can buy a better result at this step without making the final outcome unsafe or impossible to inspect.
| Step question | Zero budget | Bounded budget | Agent budget |
|---|---|---|---|
| Can the correct rule be written now? | Yes, with examples for every branch. | The path is fixed but one input needs interpretation. | No; evidence discovered during the task determines the next step. |
| What may the system choose? | Nothing outside coded values. | One label, extraction or draft inside a schema. | One of an allowlisted set of tools and reversible actions. |
| How is it bounded? | Types, conditions, tests and permissions. | Prompt, schema, confidence rule and fallback. | Tools, turns, time, spend, scope and stop conditions. |
| What proves it worked? | The resulting state equals the expected state. | The output passes validators and a task-specific rubric. | The goal is satisfied with retained evidence and no safety failure. |
| What happens when it cannot pass? | Fail visibly; retry only known transient errors. | Route the original input and attempted output for review. | Stop, preserve the trace and hand the live state to a named person. |
The budget has to exist before production. Anthropic's 2026 guide to evaluating agents describes why outcome evaluation is harder than checking a fixed path: an agent can reach a better answer through a route the test author did not anticipate. That makes task-specific success cases more important, not less. “Looks reasonable” is not a rubric.
Worked hybrid: an invoice exception without agentic accounting
Trigger, deterministic. An invoice record arrives with a purchase-order number. Code loads the order and receipt records, normalises currency and identifiers, and calculates line-level differences. No model should choose the maths or the tolerance.
Known branch, deterministic. If the identifiers match and every difference is inside the organisation's stated rule, the record moves to the normal approval queue. If the supplier or order is missing, the run stops in a named exception queue.
Messy evidence, bounded model judgment. A note attached to the receipt says the quantity changed because part of the order was substituted. A model extracts the claimed reason and referenced line items into a fixed schema. Code checks that every extracted identifier exists. The model does not decide whether the invoice is payable.
Open investigation, small agent budget. If the note references a prior email but gives no date, an agent may search the approved mailbox and order folder for a matching conversation. It can read only those sources, may take at most six tool actions and must attach evidence for any match. No match ends the loop; it does not trigger a broader search.
Decision, human. The accounts-payable owner receives the calculation, structured explanation and linked evidence. They approve, reject or request clarification. The final action records their identity and reason.
Codification. If the same substitution pattern appears repeatedly and the organisation adopts a rule for it, that branch moves out of the agent budget and into code. A good hybrid becomes more deterministic as the process learns.
Five things that should not become agentic by accident
- Arithmetic. Let a model locate the numbers if the document is messy; let code calculate with them.
- Permissions. The allowlist of systems, records and actions comes from policy. The agent does not expand its own authority to finish the task.
- Hard thresholds. Contract limits, approved tolerances and routing rules belong in versioned configuration, not a prompt.
- Evidence retention. The run record captures tool inputs, outputs, sources, decisions and stop reason regardless of what path the agent chose.
- Final accountability. A consequential action stays behind a human gate when policy says a person must own it. More confident model output does not rewrite the policy.
NIST's AI Risk Management Framework asks organisations to document roles for human-AI configurations, monitor systems throughout their lifecycle and consider viable non-AI alternatives. That leads to a plain design rule: an agentic step should justify itself against the deterministic alternative every time it survives a review.
How a healthy workflow moves between the levels
- 01Observe the manual processHuman approvalCapture cases, corrections and the evidence people use. Do not automate the tidy procedure while the real exceptions remain in somebody's inbox.
- 02Code every settled ruleCodeFixed inputs, calculations, thresholds, routes and writes become deterministic first. This gives the variable parts a stable shell.
- 03Bound the irreducible judgmentAI judgmentStart with one schema-constrained model step. Add an agent loop only if useful actions genuinely depend on observations made during the task.
- 04Evaluate in observation modeHuman approvalLet the system produce proposed paths without taking the final action. Score real cases, including the failures, against the pass condition.
- 05Codify repeated successful choicesCodeWhen the same decision recurs and the rule is now understood, move it into code. The agent budget should shrink as the process becomes known.
The minimum evaluation pack for an agentic step
A deterministic branch can often be tested with a compact input-output table. An agentic step needs cases that exercise choice and stopping. Begin before release with at least five shapes, then add every production correction to the pack. The point is not a universal benchmark; it is a regression set tied to this job.
| Case | What it tests | Required record |
|---|---|---|
| Ordinary success | The shortest legitimate path reaches the goal. | Actions, sources, output checks and stop reason |
| Legitimate alternate path | A different sequence can still satisfy the same outcome rubric. | Why the alternate tool or order was selected |
| Missing evidence | The system asks, searches within bounds or stops rather than inventing. | The gap, attempts and fallback destination |
| Misleading input | Untrusted content cannot redirect tools or expand permissions. | Rejected instruction and the policy that rejected it |
| Forced budget stop | The run preserves useful partial state at its turn, time or spend ceiling. | Live state, completed actions and next safe human action |
Grade at three levels. Code checks schemas, allowed tools and forbidden actions. A task rubric checks whether the result solves the operating need and cites its evidence. A person reviews cases where reasonable experts can disagree. Anthropic's evaluation guidance describes the same mix of code-based, model-based and human graders; the proportion depends on the job.
Do not promote the step because the average score improved while one safety case regressed. Separate release gates from quality measures. A minimum source requirement, forbidden action or permission boundary is pass/fail. Style and efficiency can be scored. Combining them lets a polished answer compensate numerically for an action the system was never allowed to take.
Review what stays agentic
Schedule a review after the first twenty useful runs and then at a cadence matched to change. List the choices the agent made more than once. For each, ask whether a process owner can now state the rule. Move settled choices into code, add novel failures to the evaluation pack, remove tools that were never needed and confirm that the human fallback still receives complete state.
The review protects against two opposite failures: a brittle workflow that never learns from exceptions, and an agentic system that keeps paying for flexibility after the process has become known. A hybrid is a moving boundary, not a permanent ratio.
Comparison method and date
This category comparison was checked on 28 July 2026. It uses Anthropic's published distinction between predefined workflows and agents, its current agent-evaluation guidance, and NIST's lifecycle risk outcomes. It does not compare named products, models, prices or benchmark scores.
The variance-budget table was applied to the simulated invoice exception one line at a time. Each step was assigned the least variable performer able to do the work, then checked for an input, output, pass condition, bound and fallback. That paper test is reproducible; it is not a performance test of software.
Limitations and when not to use this
- Deterministic does not mean reliable. Fixed code can encode the wrong rule, use stale data or fail silently. It is easier to test precisely, which is an opportunity rather than a guarantee.
- Agentic is a matter of runtime path choice, not a vendor label. Products use the term differently; inspect what the model is actually allowed to decide.
- This page compares architecture categories and has not been independently reviewed by a named product reviewer. It makes no product, price, connector or benchmark claim.
- The invoice example is simulated and is not accounting, tax or legal advice. The invoice playbook covers that job's operational design in more detail.
Sources
- Building effective agents — Anthropic Accessed 28 July 2026
- Demystifying evals for AI agents — Anthropic Accessed 28 July 2026
- AI Risk Management Framework Core — NIST Accessed 28 July 2026
Mark up one real procedure
Take the procedure you already use and label every line code, judgment or human gate. The missing branches become visible before you choose a tool.
Mark up one real procedureUli Prantz
Builds and operates all-agents
Uli Prantz builds all-agents, the process-automation platform this site documents. He writes about the operational side of automating recurring business work: where deterministic code beats model judgment, where it does not, and where a human still has to approve.