Letting a model choose every next step can work for small, low-risk tasks. It is a bad default for workflows that touch customer data, money, access control, compliance, or changes that are hard to undo.

Production systems usually combine model judgment with explicit application control. The model may classify an intent, extract fields, choose from approved options, or summarize results. The application decides which states exist, which transitions are allowed, which tools can run in each state, and when a human must approve.

In practice, reliable AI features use a simple rule: retrieve before answering, validate before writing, confirm before destructive actions, log every side effect, and use deterministic checks wherever possible.

In this chapter, you will design structured workflows around tool use: risk levels, confirmation gates, audit trails, budgets, human review, testing, and a guarded data-management assistant.