# Agents and durable workflows

> How durable workflows, typed tools and approval signals let an agent carry out a process with a person signing off each decision.

- Web page: https://www.alesanalytics.com/docs/agents-and-durable-workflows
- Markdown: https://www.alesanalytics.com/docs/agents-and-durable-workflows.md
- Last updated: 2026-11-08
- Publisher: Ales Analytics

Technical page. The model proposes, the workflow decides. Published 2026-11-08. Last reviewed 2026-11-08. Reviewed by Ales Analytics engineering.

## In one paragraph

An agent is software in which a model proposes the next step of a task and the system carries it out. In a business setting the useful pattern is a durable workflow: the process is written down as explicit steps in a workflow engine, the model proposes actions within those steps, the workflow decides whether each action is allowed, and a person approves anything that cannot be undone. Every step is recorded and can be replayed.

## How it works

- **Workflow engine.** An engine such as Temporal records each step in an event history and resumes after a failure exactly where it stopped. Workflow code is deterministic; model calls and API calls run as activities whose results are recorded.
- **Typed tools.** Each action the agent can take is a tool with a typed interface and the narrowest access that works. The Model Context Protocol is one standard way to expose tools.
- **Approvals.** Any write action waits for an approval signal from a named person, with a timeout and an escalation path.
- **Untrusted input.** Documents, emails and tool results are treated as data that may contain instructions; steps that read them have no write tools.
- **Audit log.** An append-only record of every proposal, decision, tool call and approval.

![Figure 1. A durable approval step, replayable from its event history.](https://www.alesanalytics.com/diagrams/sa-approval.svg)

## Design choices and trade-offs

| Choice                                        | Trade-off                                                                                                         |
| --------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
| Explicit workflow vs open-ended agent loop    | Explicit steps are predictable and auditable; open loops handle unexpected cases but are harder to bound and test |
| Approval on every write vs on selected writes | Every write is safest; selected writes reduce review load once a step has a measured track record                 |
| MCP vs direct API wrappers                    | A standard protocol eases reuse across tools; direct wrappers are simpler for one or two systems                  |

## When not to use it

When the process is fully rule-based, write the rules; no model is needed. When a step requires judgement that cannot be checked afterwards, keep a person doing it and use the system to prepare their information.

## How we evaluate it

Replay a test set of historical cases through the workflow in a sandbox. Report task completion, the share of steps the model proposed correctly, the share needing human correction, and every case where a proposed action would have been blocked by policy. Security testing includes injected instructions in documents and tool outputs.

## Sources

- [Temporal: workflow execution](https://docs.temporal.io/workflow-execution)
- [Model Context Protocol specification 2026-07-28](https://modelcontextprotocol.io/specification/2026-07-28/changelog) and [security best practices](https://modelcontextprotocol.io/specification/2026-07-28/basic/security_best_practices)
- [OWASP Top 10 for LLM Applications](https://genai.owasp.org/llm-top-10/)
- Explainers: [AI agents](https://www.alesanalytics.com/explainers/ai-agents), [Human sign-off](https://www.alesanalytics.com/explainers/human-in-the-loop)

## Contact

solutions@alesanalytics.com, or https://www.alesanalytics.com/contact.

- Every page as Markdown: https://www.alesanalytics.com/llms.txt