Agent Loop vs LLM-in-Workflow: Pick the Shape That Matches the Uncertainty
Most jobs need a workflow with one LLM step, not an agent loop. Use a three-tier test — certainty, branching, blast radius — then prove hybrid is enough.
You usually need a workflow with one LLM step — not a full agent loop. An agent earns its keep only when the next action cannot be named until mid-run, the long-tail branches explode a scripted graph, and you can afford the cost and failure modes that come with open-ended tool use. Pick the shape that matches the uncertainty, not the buzzword on the slide.
This spoke sits under the Agentic Systems Operating Manual. It owns the hybrid middle. For the hard “no agent” cases, see when not to build an agent.
The short answer
- Tier-1: deterministic workflow — no model, or a model used only offline to design the flow.
- Tier-2 (default): workflow + one bounded LLM step (classify, extract, draft) with schema-checked I/O.
- Tier-3: agent loop — plan → act → observe → decide, with tools, budgets, and evaluators.
- Wrong shape taxes you twice: Tier-3 burns tokens on solvable graphs; Tier-1/2 silently fails when the long tail needs mid-run decisions.
- Prove Tier-2 first. Graduate to Tier-3 only when you have failure traces that a scripted graph cannot absorb without becoming a second product.
What is an agent loop vs a scripted workflow?
| Shape | Who picks the next step | Tool calls | Typical failure |
|---|---|---|---|
| Scripted workflow | You, at design time | Fixed edges in n8n / code | Missing branch, silent skip |
| Workflow + LLM step | You for routing; model for one transformation | Fixed; model never chooses tools | Schema miss, bad extract |
| Agent loop | Model + harness at runtime | Dynamic, policy-gated | Loops, wrong tool, cost blowups |
An LLM step is a node: input in, structured output out, next edge known. An agent loop is a control plane: the model may propose tools, the harness may allow or deny them, and termination is earned (done, escalate, abort) — not a final webhook hop.
If you can draw every edge on a whiteboard before the first production ticket arrives, you are still in workflow land.
Why wrong shape blows cost and reliability
Agent loops pay a planning tax on every turn: context, tool schemas, retries, and evaluator rounds. That is fine when the alternative is a human. It is wasteful when a classifier plus three IF nodes would finish the job.
Workflows fail the other way. You encode the happy path, miss the ugly path, and ship a “successful” run that wrote the wrong CRM field because no model was allowed to notice the exception.
| Wrong choice | What you feel in week two |
|---|---|
| Agent for a form parse | 10× token bill vs a single extract call; flaky tool retries |
| Workflow for messy exceptions | Escalation pile grows; humans rewrite “automation” output |
| Hybrid without schema checks | LLM step drifts; downstream nodes trust garbage |
Cost is not only tokens. Wrong-shape agents also burn eng time debugging loops that a state machine never should have entered.
The three-tier test
Run every candidate job through these questions in order. Stop at the first tier that fits.
1. Certainty of the next action
- Can you name the next system call before looking at the payload? → Tier-1 or Tier-2.
- Does the next call depend on free-form content you have not seen yet? → Candidate Tier-3.
2. Branch count and long-tail rate
- Under ~10 stable branches, update the graph. Prefer Tier-2.
- Long-tail exceptions that keep inventing new branches after every release → Tier-3 may earn itself.
3. Blast radius if the model is wrong
| Side-effect class | Prefer |
|---|---|
| Read-only / draft-only | Tier-2 LLM step is fine |
| Reversible write (draft email, note) | Tier-2 with human review, or Tier-3 with tight policy |
| Irreversible (charge, delete, public post) | Default Tier-2 + human gate; Tier-3 only with pre-execution deny |
If blast radius is high and certainty is low, you still might not want an agent — you might want a human. Agents are not a courage substitute.
Tier-2: workflow + one LLM step (the default)
Pattern that ships:
- Trigger (webhook, form, inbox).
- Normalize + validate input mechanically.
- One model call with a strict schema (JSON Schema / Zod / structured output).
- Mechanical checks on the schema (required fields, enums, ranges).
- Deterministic routing and writes in n8n or code.
- Escalate path when checks fail — no silent “best effort” write.
Example jobs that stay Tier-2 for a long time:
- Intent classify → route ticket
- Extract fields from an invoice PDF → Airtable row
- Draft a reply → human send
- Summarize a Zoom transcript → Notion page with fixed template
n8n is a natural host for this shape: the graph owns control flow; the model owns one transformation. Do not let the LLM step call tools “just in case.” That silently becomes Tier-3 without the harness.
When you’ve earned a real agent loop
Signals from production, not from a demo:
- Same exception class keeps adding branches to the workflow after three releases
- Humans already do multi-step research across tools with mid-course corrections
- You can stub tools and score trajectories on a golden set
- You have budgets, kill switches, and a policy gate before side effects
- Cost of a failed autonomous run is bounded and recoverable
If those boxes stay unchecked, keep Tier-2. Fashion is not an acceptance criterion.
Hybrid: n8n owns the spine, loop owns the long tail
A clean hybrid:
| Layer | Owns |
|---|---|
| n8n / workflow | Triggers, auth, deterministic writes, SLAs, retries with idempotency |
| Bounded agent | Only the exception lane: “research + propose” or “triage + draft” |
| Policy + evaluator | Allow / deny / escalate before irreversible tools |
Contract between layers:
- Workflow calls the agent with a job package (goal, allowed tools, budget, deadline).
- Agent returns a result package (status, artifacts, reason codes) — never raw chat.
- Workflow decides the write. The agent does not hold production credentials for blast-radius tools unless the pilot explicitly scopes them.
This is how you keep ops familiar (n8n runs, alerts, retries) while still using a loop where uncertainty lives.
Measuring whether hybrid is enough
Do not argue architecture. Instrument a two-week trial of Tier-2 and score:
| Metric | Tier-2 is enough if… |
|---|---|
| Human rewrite rate | Under your job’s tolerance (often <15% for drafts) |
| Silent wrong writes | Near zero on sampled audits |
| New branch requests | Not growing week over week |
| Cost per successful job | Inside the band finance already approved |
| Time-to-escalate | Humans get a package faster than doing the job cold |
If rewrite rate stays high and the failures are “needed another tool / another look,” you have evidence for Tier-3. If failures are schema and template issues, fix Tier-2 — do not promote the model to CEO.
Failure mode: the faux agent
What breaks: a “agent” that is really while true: call model; call every tool with no state machine, no evaluator, and no policy gate.
What it costs: duplicate emails, duplicate CRM notes, token bills that make the chatbot demo look cheap, and a team that stops trusting automation.
What you do instead:
- Collapse to Tier-2 for the happy path.
- Put the long tail behind an escalate package.
- Only then stand up a bounded loop with max turns, tool allowlist, and offline golden-set gate.
Bravery is not a restore strategy.
Decision checklist (print this)
- I can state the job in one sentence with a done definition
- I tried Tier-2 with schema-checked I/O for two weeks of real traffic (or a dense fixture pack)
- I know which tools are read vs write vs irreversible
- I have an escalate path that humans will actually use
- If Tier-3: budgets, traces, evaluator, and pre-execution policy exist before soft-launch
- I am not choosing Tier-3 because a competitor’s landing page used the word “agent”
Acceptance criteria when there is no agent
Tier-2 still needs a definition of done:
- Schema validation pass rate on the LLM step
- Downstream write success with idempotency keys
- Sampled human audit score (or mechanical checks where possible)
- Explicit escalate rate — not “errors hidden in Slack”
No agent does not mean no eval. It means the eval is cheaper and mostly mechanical.
How a five-day pilot settles the shape
A Spurlock Studios $1,500 · 5-day agentic pilot is often a shape decision with receipts, not a forced Tier-3 build:
| Day | Output |
|---|---|
| 1 | Job map + three-tier score |
| 2 | Tier-2 spike in n8n (or existing stack) |
| 3 | Failure harvest from fixtures / shadows |
| 4 | Go / no-go for bounded loop; if go, thin harness |
| 5 | Metrics panel + recommendation writeup |
You leave knowing whether to keep shipping hybrid or to fund a real agent build. Scope detail lives in agent pilot scope.
Anti-patterns for this decision
“We’ll add tools later.” Tools change the threat model. Design the tier with the tools you will actually enable.
One LLM step that secretly chains five model calls. That is a loop without a harness. Count turns.
Replacing a working workflow because the board wants “AI agents.” Keep the workflow; put agents on the exception lane if anywhere.
Measuring only demo success. Demos are Tier-3 theater. Production is rewrite rate and blast radius.
Mapping common jobs to tiers
| Job | Starting tier | Graduate when |
|---|---|---|
| Lead enrich + CRM field fill | Tier-2 | Enrichment vendors disagree and need multi-hop research |
| Support macro reply | Tier-2 | Refunds / account changes need tool sequencing under policy |
| Ops research brief | Tier-3 candidate | Humans already juggle 4+ sources per brief |
| Invoice → bill pay | Tier-2 + human approve | Never fully autonomous without dual control |
| Content repurpose pipeline | Tier-2 | Brand-risk drafts need iterative critique loops |
Start left. Move right only with traces that justify it.
Cost sketch without fake precision
You do not need a vendor’s $/task fantasy. Compare architectures on the same job:
- Tokens + tool fees for 100 real cases under Tier-2
- Same 100 under a prototype loop (even if stubbed tools)
- Human minutes saved vs human minutes spent reviewing
If Tier-3 does not beat Tier-2 on successful outcomes per dollar after review cost, the loop is a science project. Pin models and keep the comparison honest when you re-run — floating aliases contaminate the experiment.
Where state machines fit
Once you choose Tier-3, do not leave the loop as free-form ReAct forever. Cage it: intake → plan → act → evaluate → revise | done | escalate. The cage comes after you prove you need autonomy — it is not a reason to skip the three-tier test.
FAQ
When is Tier-2 (workflow + one LLM) the right default?
Whenever the graph of next actions is mostly known and the model’s job is transform, classify, or draft inside a schema. That covers a large share of SMB automation: tickets, extracts, summaries, and draft replies. Escalate the exceptions; do not promote every exception into an open tool loop on day one.
What signals mean you’ve earned a real agent loop?
Repeated long-tail branches that make the workflow unmaintainable, multi-step tool work humans already do with mid-run decisions, and the control plane pieces (eval, budget, policy) ready before autonomy. Demo applause is not a signal. Failure traces are.
How does this differ from “when not to build an agent”?
That spoke owns refusal — jobs that should stay human or stay deterministic. This spoke owns the middle: when hybrid is enough, and how to graduate. Read both. Many teams need the refusal post first, then this decision tree for the remainder.
Can n8n host the workflow while a bounded loop handles the long tail?
Yes — and that is often the production shape. n8n owns triggers, credentials for deterministic writes, and SLAs; the loop returns a result package for the exception lane. Keep irreversible tools behind policy gates either way.
What acceptance criteria still apply if there’s no agent?
Schema pass rate, write success with idempotency, sampled audit quality, and a visible escalate rate. “No agent” is not “no measurement.” It is a cheaper measurement surface.
What does a Spurlock pilot prove in five days on this decision?
Which tier fits the job, with a Tier-2 spike, failure harvest, and a go / no-go for a bounded loop — plus the minimum metrics so the recommendation is not a vibe. Details: /agentic and pilot scope.
CTA
Pick the shape before you pick the framework.
Keep reading.
AI Agents The Evaluator Is the Product
Agent accuracy did not come from a better prompt or a bigger model. It came from separating the thing that does the work from the thing that judges it.
AI Agents Single Agent First: Split Only When Trust, Audience, or Timing Conflicts
Start with one agent and many tools. Split only when trust, audience, or timing conflict—and prove that split with pass rate, cost, and escalate rate.
AI Agents State Machines for Agent Loops: Determinism Where It Matters
Agent loops need freedom inside a cage. Explicit states, legal transitions, revision ceilings, and escalate paths are how non-deterministic models ship deterministic ops.