An unrestricted agent is a poor execution model for business files. It combines uncertain interpretation with credentials, external communication and potentially expensive storage operations.
A safer design separates understanding from authority.
Automation owns deterministic actions
- Upload and move objects.
- Rename and tag files.
- Convert supported formats.
- Extract approved archives.
- Restore deep storage objects.
- Cache approved versions.
- Send permitted notifications.
Agents provide bounded understanding
- Classify a document.
- Extract fields with source citations.
- Compare document versions.
- Identify missing items.
- Recommend the next permitted action.
Policy remains deterministic
The workflow definition controls its trigger, folders, actions, execution identity, cost limit, object limit and approval policy. An agent can propose only an action already present in that allowlist.
Approval belongs at the consequence
External email, overwrite, delete, extraction and material provider cost should pause at the exact step where the consequence becomes real. The approval must describe the destination, expected impact and execution identity.
Recovery is part of the feature
- Idempotency prevents duplicate writes and messages.
- Quarantine keeps unsafe input visible.
- Retry state explains whether another attempt is safe.
- Run history records the trigger, decisions, actions, approver, cost, result and redacted errors.
Let agents interpret. Let policy authorize. Let durable automation execute. That boundary makes intelligent workflows useful without giving uncertain output unrestricted control.