Keep business rules outside model discretion

Learning objective

Decide which workflow steps require deterministic logic or autonomous reasoning.

Core idea

When you design a mixed workflow, ask what makes a decision correct. If a published rule and validated inputs determine the answer, implement that rule in code. If the decision requires interpreting incomplete language, combining ambiguous evidence, or selecting a useful investigative step, bounded autonomous reasoning can help.

The distinction is about authority, not whether a step looks complicated. A long calculation can be deterministic. A short request such as “make this right” can require interpretation. Keep legal, financial, and authorization rules outside model discretion even when an agent supplies the inputs those rules consume.

Microsoft Agent Framework supports workflows containing custom logic executors and AI agents. Its graph edges can include conditions based on message contents. This gives you a concrete design: an agent proposes a value, an executor validates it, and a condition routes the validated result through permitted paths.

How it works

Classify the decision rather than the component

Break a step into interpretation, validation, and execution. An agent can classify a customer’s complaint, but it should not invent the refund formula. An executor can check account eligibility, while the agent explains which evidence supports the complaint. A tool can perform a write after the application accepts the proposal.

Use deterministic logic for exact calculations, schema checks, authorization, required ordering, and explicit thresholds. Use reasoning for extracting intent, reconciling narrative evidence, or developing a bounded investigation where the next useful step is not known in advance.

Some stages contain both. Reading a contract clause can require reasoning; applying a verified rate to a verified amount requires arithmetic. Splitting that stage avoids asking a model to reproduce calculations or to redefine rules while interpreting the text.

Put routing rules in the workflow

In Python graph workflows, WorkflowBuilder.add_edge() connects source and target executors, and its condition argument can select a path. Microsoft’s conditional-edge example routes using a classification field produced upstream. The predicate is deterministic even though an agent supplies the classification.

That separation does not make the classification trustworthy. Validate allowed values, required evidence, and completeness before routing to a consequential action. If the output is invalid, route it to correction or escalation through application-defined behavior. Do not coerce every unrecognized label into the most convenient successful path.

Make routing predicates explicit and nonconflicting where the business process requires one path. For ordered routing, Python uses add_switch_case_edge_group(source, [Case(condition=..., target=...), ..., Default(target=...)]); .NET uses AddSwitch(source, switchBuilder => ...) with AddCase() and WithDefault(target). Cases stop at the first match, so their order matters. The default handles messages only when every predicate returns false; it does not recover a predicate exception. Route unmatched values to review rather than leaving a request without a business outcome. Validation and ordered cases send a classification to correction, its first matching case, or review.

The .NET graph API uses WorkflowBuilder and AddEdge(..., condition: ...). These are language-specific interfaces to a similar architecture. Do not copy Python method names into a .NET answer or assume every framework surface accepts the same arguments.

Bound the discretionary region

An agent may choose tools within a permitted set without choosing the policy governing those tools. In Agent Framework, the tools supplied to the agent define its callable surface. Restrict that surface to the operations needed for the reasoning task. Tool implementations still validate arguments and access.

For example, an investigation agent can look up shipment events and compare explanations. It cannot issue a credit if no credit operation is exposed to it. Giving it the credit tool with instructions to be careful creates a different boundary from keeping that operation behind deterministic workflow control and approval.

If an action requires approval, the Python function-tool mechanism is @tool(approval_mode="always_require"). It pauses execution for an approval response rather than relying on the agent to remember an instruction. See 1.1.6 for human checkpoint design; here the point is that reasoning can propose an action without owning permission to execute it.

Choose an orchestration only when uncertainty needs it

The Azure Architecture Center distinguishes sequential orchestration, where agents run in a predefined order, from handoff, where the next specialist emerges from context. It advises against handoff when the correct agent or sequence is identifiable from the initial input; deterministic routing or a simpler dispatcher fits that case.

Known ordering does not eliminate reasoning within a stage. A fixed sequence of extract, interpret, validate, and approve can contain an agent in the interpretation stage. Conversely, a dynamic dispatcher does not make every downstream operation autonomous.

Agent Framework also documents an experimental Python functional workflow API using native control flow. The graph API is sufficient for the decisions in this lesson. Do not confuse “functional workflow” with “deterministic result”: either representation can invoke agents, and a graph can carry nondeterministic outputs.

Key distinctions and trade-offs

Deterministic routing versus reliable evidence: A predicate evaluates the same input consistently. It cannot correct a false claim in that input. Evidence validation remains a separate responsibility.

Reasoning versus permission: An agent can decide that an operation would help. The application decides whether the operation is allowed. Tool availability and approval gates implement that separation.

Flexibility versus auditability: Dynamic reasoning handles varied language and uncertain investigation paths. Deterministic logic makes rule application reproducible and easier to explain. Combine them around an explicit proposal-and-validation boundary.

Fixed sequence versus fixed answer: Sequential orchestration fixes order, not generated content. A system can preserve mandatory business steps while allowing a specialist to interpret evidence within one of them.

Architecture / decision scenario

A travel company processes cancellation requests. Customers describe disruption in free text, and eligibility depends on booking dates, fare terms, and documented exceptions. You separate the workflow into interpretation, rule application, and authorized execution.

An agent interprets the message and proposes a disruption category with supporting text. A validation executor rejects unsupported categories or missing evidence. A deterministic executor applies the company’s versioned cancellation rules to verified booking data. Exact amounts come from a calculation tool, rather than from generated prose.

A switch-case edge group routes eligible cases to a resolution proposal and recognized exceptions to human review. Its Default(target=review_executor) routes unmatched categories to review instead of authorizing a refund. The agent can investigate missing travel evidence through read tools, but cannot rewrite fare rules. The refund function requires approval before execution.

The company knows these stages in advance, so a fixed workflow fits. Handoff would add discretion to specialist selection without solving the actual uncertainty, which lies in interpreting the customer narrative. If evidence remains contradictory, the terminal outcome is review required, not a model-selected exemption.

Common exam traps

• Treating every complex step as a reason to use autonomous reasoning.
• Calling an entire workflow deterministic because its graph is fixed.
• Letting a classifier’s unvalidated output directly authorize a write.
• Using handoff when a known predicate already identifies the correct specialist.
• Treating a prompt instruction as equivalent to an enforced tool approval gate.

What to remember

Put explicit rules and permissions in code. Let agents interpret uncertain evidence and propose bounded next steps. Validate their outputs before deterministic conditions route them, and choose dynamic orchestration only when the coordination itself requires reasoning.

Knowledge check

References

• Microsoft, Workflows — Executors
• Microsoft, Workflows — Edges
• Microsoft, Workflow concepts
• Microsoft, AI agent orchestration patterns
• Microsoft, Using function tools with human in the loop approvals