All courses / AI Platform and Security / Module 2 / Chapter 11
Learning objectives
After the lesson the participant can:
- Distinguish a workflow from an agent and choose the pattern with the least autonomy that meets a requirement.
- Explain the four conditions under which autonomy is bounded.
- Draft a deny-by-default permission manifest with effect classes, argument constraints, budgets and a stop block.
- Review an approval policy for the three design decisions that make a gate work.
Key concepts
- Workflow and agent
- In a workflow the control flow is written in code and the model fills in content. In an agent the control flow is delegated to the model, which selects a tool, observes the result and selects the next until a goal or a limit is reached.
- Bounded autonomy
- Autonomy is bounded when the agent can only reach explicitly granted tools, each tool call executes under a least-privilege identity, actions above a defined risk threshold require approval, and steps and spend are capped.
- Permission manifest
- The agent's declared intent in a versioned artefact: what it is for, which tools it may call with which arguments, under which identity, and which actions require a human. Nothing the model emits can extend it.
- Effect classification
- The labelling of each tool on a registered server as read, reversible-write or irreversible. It lets the pipeline check that every irreversible tool in a manifest carries an approval requirement, and lets a tool be prohibited for agent use outright.
- Approval gate
- The architectural form of human oversight for agents. It presents the action with enough context, binds the approval to the specific action with an expiry, and treats a timeout as a safe stop, never as silent approval.
Interactive exercises
Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.
Interactive exercise 1 · Sort
Who owns the control flow?
Sort each pattern by the owner of its control flow in the chapter's table.
Interactive exercise 2 · Scenario
Approvals that keep timing out
Apply the chapter's three design decisions for approval gates to a proposal at Hansa Mutual.
Teaching plan
| 15 min | The teacher presents the six patterns ordered by autonomy and the test: if a competent analyst could write down the steps in advance, build a workflow. |
| 25 min | Read Hansa Mutual's tool server registration, the motor claims skill and the IT-operations manifest; participants mark every line that is enforced outside the model. |
| 15 min | Study the approval policy and the stop block of the claims-triage agent, then match the five failure modes to their controls. |
| 40 min | Exercise: design review of a proposed agent, producing a manifest and an approval rule; each group presents the action it refused to grant and why. |
| 10 min | Close with the contrast: Nordvik Region limits agency by not granting it, Hansa Mutual by making the jurisdiction part of every permission. |
Discussion
- A gate that approves by default under time pressure is called worse than no gate. Where in your organisation does an approval step produce evidence of oversight that did not occur?
- A skill changes what the agent is told, never what it is permitted to do. Which of your current controls on AI tools are instructions, and which are enforced by the platform?
- Nordvik Region runs no autonomous production agents because it cannot yet answer who took the decision and on what grounds. Which questions would your organisation have to answer first?
Written exercise
Exercise · 40 minutes
Design review: a manifest for a proposed agent
A team proposes an agent that acts on a business system in your organisation; if you have no candidate, take an agent that prepares document requests in Hansa Mutual's claims system. First decide whether a workflow would do and record the reason. Then write a deny-by-default permission manifest: purpose, prohibited uses, identity with token lifetime, each granted tool with its effect class and conditions or argument constraints, the actions that require approval with approver role and expiry, the things the agent may never do, budgets for steps, cost and time, a stop block with kill switch, stop conditions and safe state, and audit retention. Add one approval rule bound to the exact action with the behaviour on timeout.
Deliverable: A permission manifest of one page, an approval rule, and a three-line note on why an agent and not a workflow was justified.
Self-test
Choose an answer to see whether it is right, or open the answer below each question.
What is the distinction that matters between a workflow and an agent, according to the chapter?
Show the answer
B. Who owns the control flow
In a workflow the control flow is written in code; in an agent it is delegated to the model. A workflow has a finite set of paths to test, an agent an open set that can only be bounded.In Hansa Mutual's approval policy, what does binding an approval to the action hash achieve?
Show the answer
D. The handler approves the request they were shown, not whichever request the agent sends next
The approval covers one tool call with its exact arguments, expires, and a timeout results in reject and stop, never in approval by default.Which statement about the AGENTS.md file in a repository matches the chapter?
Show the answer
A. It carries instructions, not enforcement, so it is paired with controls the agent cannot override
The instructions file says what is expected; branch protection, code-owner approval and the runner policy make what is forbidden impossible.