Anthropic draws a useful line between workflows, where code predetermines the path, and agents, where the model directs its own process and tool use.[2] The boundary is practical rather than metaphysical. A system can classify the message with a model, retrieve policy with RAG, and still execute a deterministic refund workflow.

Give the model control only where enumerating every branch would be brittle. Keep identity checks, refund ceilings, inventory reservations, and payment mutations in deterministic code. This hybrid is usually easier to test than a loop that asks the model to rediscover business rules on every turn.

The model interprets the request, weighs available context, and proposes a next action. It should not be your database, policy engine, or permission system. Model selection is an empirical decision: start with a capable baseline, build evaluations, then test whether smaller or faster models preserve the required behavior.[1]

The original draft compared named models with a dated leaderboard. That creates false precision. A benchmark mean does not tell you whether a model will correctly handle your refund policy, tool schemas, error states, or latency budget. Your evaluation set should.

Tools let the agent fetch Order 4821, read the damage policy, check replacement stock, calculate an allowed refund, or submit an approved mutation. Clear names, precise parameter descriptions, validated inputs, and useful error responses matter because the model sees the interface—not your intent.

Model Context Protocol standardizes how hosts connect models to focused servers that expose tools and contextual data, but a common protocol is not a security boundary by itself.[3] Authentication, authorization, least privilege, logging, and user consent still belong to your application.

Short-term state may include the customer’s verified identity, retrieved policy version, tool results, pending actions, and remaining budget for this run. Long-term memory is a separate product decision. Persisting preferences or outcomes can improve continuity, but it creates retention, privacy, deletion, and stale-data obligations.

For Order 4821, the durable record should live in the order and support systems. The agent’s working context should reference those sources of truth. A vector store is useful for semantic retrieval; it is not an authoritative ledger.

NIST’s Generative AI Profile frames risk management across design, development, deployment, use, and evaluation rather than treating safety as a final filter.[4] Apply that lifecycle to the agent’s actual capabilities. A support agent that drafts replies has a different risk surface from one that moves money or reserves inventory.

Build evaluations from representative tasks, edge cases, and known failures. Grade intermediate behavior: policy retrieval, argument validity, tool choice, refusal, escalation, and final state. OpenAI’s evaluation guidance recommends task-specific evals, logging, automation where possible, and continuous evaluation as the system changes.[5]

For Order 4821, a polished apology is not success if the system refunds twice, invents Friday delivery, or replaces the wrong SKU. Your strongest checks inspect deterministic outcomes: the correct order was accessed, policy version was recorded, the refund stayed within limits, and the reservation actually exists.

Start with one agent and a small tool set. OpenAI’s practical guide explicitly recommends maximizing a single agent before splitting work across multiple agents because added agents introduce overhead and complexity.[1] Add a specialist only when its separate instructions, tools, context, or evaluation boundary are genuinely easier to maintain.

A multi-agent design is not automatically more resilient. It creates more prompts, handoffs, context boundaries, failure modes, and token traffic. Anthropic’s production account finds the pattern strongest for breadth-first, parallelizable research and a poor fit when agents must share context or coordinate dependencies.[9] Splitting Order 4821 among five conversational roles would mostly create coordination latency around one shared transaction.