What Is an Agentic Workflow? A Precise Definition for Builders

An agentic workflow is a structured, multi-step process in which an AI agent acts as a participant, not just a tool called once and forgotten. The agent receives context, takes an action or produces an output, and that output influences what happens next in the workflow, whether the next step is another AI model, a human reviewer, an external API call, or a routing decision.

Three properties distinguish an agentic workflow from a simpler AI integration:

• The agent's output has consequences within the process. It is not just returned to a user. It routes to another step, triggers a review, updates a record, or branches the workflow based on its content.
• The process has defined structure. There is a beginning, a sequence of typed steps, and an end. The platform knows the state of every step and can pause, resume, branch, or escalate based on what happens at each one.
• The execution is governed. Permissions control who can trigger, build, review, and report on the workflow. Credentials are secured. Every action is logged. The process is auditable after the fact, not just observable in the moment.

Without all three properties, you have an AI integration. With all three, you have an agentic workflow.

The word 'agentic' comes from agency: the capacity to act. In the context of a workflow, an AI agent has agency when its outputs drive the process forward rather than simply being returned to a waiting user.

In DAVE, AI agents participate in workflows through two dedicated node types. The Agent Interaction node invokes an AI model with a defined set of inputs: context from earlier steps, instructions set by the workflow designer, and credentials stored securely in the platform's per-tenant vault. The model produces an output, and the workflow continues to the next node based on that output.

The Agent Review node routes the output of one AI model to a second model for evaluation. This enables automated quality gates: the reviewing agent can assess accuracy, tone, safety, or any other dimension the workflow designer specifies, and the workflow branches based on the review result. Two AI agents, each with a defined role, each operating within the governed structure of the workflow.

DAVE supports seven AI provider types as the model layer inside these nodes: OpenAI, Anthropic, Azure OpenAI, Google, OpenAI-compatible endpoints, local models via Ollama, and fully custom providers. You bring your own keys; the platform never proxies or marks up your AI usage. The choice of provider is a configuration decision, not an architectural one, and different nodes in the same workflow can use different providers.

A common misconception about agentic workflows is that 'agentic' means 'fully autonomous'. In production, the opposite is usually true. The most robust agentic workflows are the ones that include humans at the points where human judgment is irreplaceable, and that enforce those human steps rather than leaving them optional.

DAVE's Human Review node is the mechanism for this. When a workflow reaches a Human Review node, execution pauses. A named reviewer receives the AI-generated output and makes a decision: approve, reject, or modify. The workflow resumes only when that decision is recorded. The reviewer's identity, the time of the decision, and the decision itself are all captured in the audit log.

The User Interaction node serves a related but distinct purpose. Rather than reviewing AI output, it collects structured input from a human participant, pausing the workflow until that input is provided. This is the entry point for processes that gather information progressively, where the AI's next action depends on what the human supplies at a specific step.

Together, Agent Interaction, Agent Review, Human Review, and User Interaction nodes make it possible to design workflows where AI and human participants each do what they are best at, within a structure that enforces the handoffs between them. That is what distinguishes a well-designed agentic workflow from an autonomous agent running without guardrails.

An agentic workflow is more than its AI nodes. The complete structure includes every type of step the process requires, and DAVE's ten node types cover the full surface of a production agentic process.

• Start defines the entry point and the inputs the workflow expects. Every workflow instance begins here, and the platform records the trigger, the triggering user, and the initial inputs.
• End closes the instance and finalises the audit record. The platform knows the workflow is complete, not just that the last step ran.
• User Interaction collects structured input from a human participant at any point in the process.
• Human Review routes AI output to a named reviewer and pauses execution until a decision is recorded.
• Agent Interaction invokes an AI model with defined context, instructions, and secured credentials.
• Agent Review routes AI output to a second model for automated evaluation.
• Routing branches the workflow based on conditions: the content of an AI output, the result of a review, the value returned by an API call, or any other defined condition.
• API Call connects to external services, making the workflow an integration layer as well as an AI layer.
• Information injects static or dynamic context into the execution graph, keeping agent prompts grounded in real data rather than relying on the model's training alone.
• Safety applies guardrails at any point in the graph. Safety checks are not confined to the final output: they can be placed before an agent acts, after it produces output, or at any other point the workflow designer identifies as a risk boundary.

A workflow that uses all of these node types in the right combination is not just an AI integration. It is a governed, auditable, multi-actor process in which an AI agent plays a defined and bounded role.

The governance layer is what separates an agentic workflow from an agentic experiment. Without it, you have a capable AI doing things in production that no one can fully account for. With it, you have a process that a team can operate, a compliance team can audit, and a customer can trust.

In DAVE, governance is structural rather than optional. Six default tenant roles (Admin, Create, Curate, Use, Reporting, and Financial) control who can build, run, review, and report on workflows. Roles are editable, so teams can model their actual org structure. Twenty permission types are enforced at both the API and the frontend level, so a permission boundary cannot be bypassed by calling an endpoint directly.

Credentials used inside Agent Interaction nodes live in a per-tenant vault encrypted with AES-256-CBC. Once stored, a credential is never returned through the API. An agent can call an external service or an AI provider without any team member seeing the key in plaintext after initial setup.

Every action taken inside a workflow, by a human or an AI, is recorded in a full audit log. DAVE supports SOC 2 and GDPR compliance modes. Per-tenant encryption ensures one tenant's data is never accessible to another. For any agentic workflow that touches customer data, financial records, or compliance-sensitive outputs, this is not an optional layer: it is the foundation that makes the workflow safe to run.

If you are assessing whether a platform can support genuine agentic workflows, five questions cut through the marketing quickly.

1. Can the platform enforce a mandatory human review step? Not as a workaround or a notification, but as a first-class workflow node that pauses execution and resumes only when a recorded decision is made. If the answer is no, the platform cannot support a production agentic workflow for any process where human judgment matters.
2. Can different AI providers be used on different steps of the same workflow? Agentic workflows often benefit from using a fast, cheap model for initial classification and a more capable model for generation or review. A platform that locks you to one provider limits your design options.
3. Are credentials stored in an isolated, encrypted vault, and are they never returned through the API? An agent that calls external services needs credentials. How those credentials are stored and accessed is a security question with a right answer.
4. Does the platform produce a complete audit trail for every workflow instance? Not just a log of errors, but a record of every input, every AI output, every human decision, and every external API call, tied to a specific run.
5. Are permissions enforced at the API level, not just the UI? A permission boundary that can be bypassed by calling an endpoint directly is not a permission boundary.

DAVE's 30-day free trial supports up to five seats, which is enough to build a real agentic workflow, connect your own AI provider keys, and verify the governance layer against these questions in practice. Starter plans begin at $20 per month for one seat after the trial. Team plans cover five seats at $50 per month, and Business plans cover 25 seats at $250 per month, with additional seats at $10 per seat per month beyond 25.