ImageFirm Intelligence · Fact-check

How AI agents actually work.

The infographic gets the central idea right: agents combine models with tools and iterative control. But it compresses important distinctions—and its guardrail model is too thin for production systems. This page rebuilds the concept around current engineering guidance.

Reviewed 06 Sep 2026Primary sources: OpenAI · Anthropic · NIST · LangChainNo framework dependency

Overall verdict

Strong teaching graphic, incomplete production model.

8.2/10

5claims essentially correct

4need important nuance

0fundamentally false claims

What needs correcting?

Workflow → agent is not a maturity ladder. They are different orchestration patterns; a workflow can be the better design.
The “agent decides” statement needs boundaries. The model chooses within permissions, code, policies, budgets and stop conditions.
The loop is a useful abstraction, not a universal protocol. Many runtimes reduce it to repeated model calls + tool execution.
Guardrails are more than input/output filters. Authorization, sandboxing, approvals, least privilege, tracing and rollback matter.

01 · Architecture

Replace the ladder with a decision model.

Anthropic explicitly distinguishes workflows—where LLMs and tools are orchestrated through predefined code paths—from agents, where an LLM dynamically directs its own process and tool use. One is not automatically “more advanced” or better.

Model

Generates, classifies or reasons from supplied context. No external action unless the application gives it tools.

LLM / multimodal model

Augmentation

Add retrieval, memory/state, tools, structured outputs, policies and context management.

capabilities + context

Orchestration choice

Use deterministic workflows when the path is known; agentic control when the next step must be chosen at runtime.

workflow ⇄ agent

Runtime + controls

Execute tools, observe results, enforce permissions, approvals, budgets, stop conditions and tracing.

production system

ImageFirm correction: Keep the first two concepts, but branch at orchestration. A deterministic workflow may be safer, cheaper and more reliable than an agent when the path is known.

02 · Claim matrix

Fact-check, line by line.

“LLM → Augmented LLM → Workflow → Agent”Needs nuance

Useful progression, wrong implication.

Models can be augmented with tools and retrieval, but workflow and agent are better treated as alternative orchestration patterns than sequential maturity levels.

Better: Model → augmentation → choose deterministic workflow and/or agentic control.

“Workflow: developer decides the path”Correct

Broadly accurate.

Predefined orchestration is the defining distinction in Anthropic’s workflow framing. Workflows can still contain branches, routers, evaluators and LLM calls.

“Agent: model decides the next move”Needs nuance

Correct only inside a bounded runtime.

The model can select next actions dynamically, but developers still define available tools, permissions, instructions, maximum turns, budgets, approval gates and termination rules.

Better: The model chooses among actions permitted by the surrounding system.

“Perceive → Reason → Act → Observe → Repeat”Needs nuance

A sound mental model, not a standard.

ReAct-style loops are widely used conceptually. Production frameworks may implement the loop more simply as repeated model calls and tool execution until a stop condition.

“Agent can answer, use a tool, hand off, continue”Correct

Representative action set.

OpenAI’s agent guidance explicitly includes tool calls and handoffs; final output is also a standard termination path.

“Number of turns can vary”Needs nuance

True—with hard limits recommended.

Agent loops can run for variable numbers of steps, but production systems should enforce maximum turns, timeouts, cost budgets and failure thresholds to prevent runaway execution.

“Guardrails at input/tool input/tool output/output”Corrected

Good start, insufficient security model.

Stage-level validation is useful, but tools that affect the outside world require authentication, authorization, least privilege, human approval for high-risk actions, sandboxing where appropriate, and auditability.

Better: Treat guardrails as layered controls across data, model, tools, identity, runtime and human oversight.

Implicit: “tool output is trusted context”Corrected

Tool results can be adversarial.

Retrieved pages, files, emails and external tool outputs may contain prompt injection or poisoned instructions. They should be treated as untrusted data, not automatically as higher-priority instructions.

“Agents use tools to act beyond text output”Correct

Strongly supported.

NIST describes the leading agent paradigm as general-purpose AI models embedded in software scaffolding that enables tool manipulation and actions beyond simple text generation.

03 · Interactive lab

Watch a bounded agent loop.

This simulation deliberately makes the hidden production controls visible. The model proposes actions; the runtime checks policy and executes only permitted actions.

Agent loop simulator

Task: “Find the latest invoice and prepare a refund draft.”

Model selects retrievalSearch invoices using a read-only tool.

Runtime validates tool callScope, identity and arguments checked.

Tool executesInvoice data returned as untrusted external context.

Model proposes refundHigh-impact write action detected.

Approval gateSystem pauses for human confirmation instead of executing automatically.

Final outputAgent returns a refund draft and audit trail.

Production agent control plane

The infographic becomes substantially safer once these layers are explicit.

Identity & authorizationWho is the user/agent? Which systems, records and actions are permitted?

Context engineeringInstructions, conversation state, retrieval, memory, tool schemas and output contracts.

Tool boundaryTyped arguments, allowlists, parameter validation, idempotency and least privilege.

Runtime budgetsMax turns, time, token/cost limits, retries, concurrency and stop conditions.

Human oversightConfirmation for sensitive, irreversible or high-impact actions; escalation when confidence drops.

ObservabilityTracing, logs, tool-call records, evals, incident review and reproducible test suites.

Key correction: “Guardrails” cannot compensate for overpowered credentials. Security starts with restricting what the agent is technically able to do.

04 · Design choice

When should you use an agent?

OpenAI’s guidance is pragmatic: use agents where decision-making is complex, rule systems are brittle, or unstructured data dominates. If a deterministic solution works reliably, it can be the better engineering choice.

Situation	Workflow	Agent	Why
Known sequence, stable rules	Excellent	Usually unnecessary	Lower variance, easier testing and lower cost.
Dynamic research across sources	Possible	Strong fit	Next steps depend on evidence discovered at runtime.
High-stakes financial action	Preferred execution path	Useful for analysis only	Keep irreversible actions behind deterministic checks and human approval.
Customer service triage	Strong baseline	Strong with escalation	Agent can interpret messy requests and choose tools, while policy gates constrain outcomes.
Simple data transformation	Excellent	Poor fit	No benefit from extra autonomy or iterative reasoning.

05 · Evidence

Primary sources used.

The fact-check prioritizes first-party engineering guidance and standards bodies rather than secondary explainers.

OpenAI — A practical guide to building AI agentsAgent definition, loops, tools, handoffs, guardrails, human intervention. Anthropic — Building effective agentsWorkflow vs agent distinction; composable design patterns. NIST — Tool use in agent systemsAgents as models plus software scaffolding and action-enabling tools. NIST — AI RMF Generative AI ProfileTrustworthiness, risk management and lifecycle controls. LangChain — Agents documentationModel/tool iteration and stop conditions in agent runtimes. OpenAI — Tools for building agentsHandoffs, guardrails, tracing and multi-agent orchestration.