When Not to Use an AI Agent: A Decision Framework

An AI agent is justified only when a model needs to manage a multi step workflow, interpret changing context, and choose among permitted actions. Repetition alone is not enough. A scheduled script can repeat work; a rules engine can apply known decisions; a form can collect complete inputs; and a person can remain accountable for judgment that should not be delegated. That distinction prevents a common procurement error: starting with an agent because it looks flexible, then discovering that the workflow needed certainty, stable rules, or authority the system should never receive. The right decision is the least complex approach that meets the operational need at an acceptable level of risk. Gate one: can deterministic software do the job? First, write the process as inputs, rules, actions, and completion criteria. If valid inputs always lead to a known action, conventional software is usually the better design. Examples include calculating a fixed discount, validating a required field, moving an approved file, sending a scheduled notice, or querying a database with a defined filter. Deterministic automation is easier to test exhaustively, cheaper to run, and simpler to audit. It does not invent a new path because an instruction was phrased differently. OpenAI's agent building guide recommends agents for workflows where deterministic approaches fall short, particularly when nuanced decisions, difficult to maintain rules, or unstructured data create real friction. The inverse is useful: if ordinary code handles the process reliably, adding model directed execution creates failure modes without adding necessary capability. Use an assistant rather than an agent when language help is valuable but execution is not. A model can summarize a case, draft options, or extract fields while a person or fixed workflow controls the final action. Gate two: is the outcome observable and owned? Do not automate a workflow that the organization cannot define. Teams need to agree on what a correct result looks like, which exceptions are acceptable, who reviews failures, and what evidence demonstrates completion. If experienced employees routinely disagree because policy is unresolved, an agent will reproduce that ambiguity rather than settle it. Ownership matters as much as evaluation. Every deployment needs a process owner with authority to set instructions, approve access, review incidents, and stop the system. A vendor cannot own the business consequence on the customer's behalf. NIST's AI Risk Management Framework organizes risk work around governing, mapping, measuring, and managing; those activities require organizational decisions before and after launch, not just model configuration. Reject or delay the use case when there is no representative test set, no reliable source of truth, no error budget, or no named owner. Document the process first, resolve policy conflicts, and collect baseline performance. The result may later support an agent, or it may reveal that process repair was the real need. Gate three: what happens when the system is wrong? Classify each proposed action by consequence, reversibility, and authority. A draft that a person can discard is different from a payment, account closure, employment decision, medical instruction, legal filing, production configuration change, or public statement. High impact decisions may also be subject to laws, professional duties, internal controls, or appeal rights that a general agent design does not satisfy. Keep humans in control when the decision requires legal authority, fiduciary responsibility, clinical judgment, sensitive interpersonal judgment, or accountability that cannot be transferred. AI may organize evidence or identify missing information, but assistance is not the same as authorization. OpenAI's practical guidance calls for human intervention around sensitive, irreversible, or high stakes actions and when failure thresholds are exceeded. A human approval button is not automatically sufficient. The reviewer must receive the evidence, proposed action, uncertainty, and material alternatives in time to make a real decision. If review becomes a reflexive click because volume is too high, the control exists only on paper. Gate four: can access be contained? An agent should receive only the data and tools necessary for one bounded job. Reject designs that require standing administrator privileges, unrestricted mailboxes, broad customer records, shared production credentials, or access that cannot be separated by user, tenant, environment, or action. Tool access changes the risk from a bad answer to a bad action. Retrieved webpages, emails, tickets, documents, and tool results can include incorrect or malicious instructions. Prompt injection attempts to make the model treat untrusted content as higher priority direction, potentially causing data disclosure or unauthorized tool calls. OpenAI's agent safety guidance states that mitigations reduce the attack surface but agents can still make mistakes or be tricked. Do not proceed when the architecture cannot enforce authorization outside the model, validate tool arguments, separate read from write operations, protect secrets, record calls, limit retries and spending, prevent duplicate actions, and revoke access quickly. A prompt saying "never reveal data" is not an access control system. Gate five: does the value survive full cost accounting? Estimate the complete operating cost: model and tool usage, latency, integration, evaluation, human review, security work, logs, incident response, vendor changes, and maintenance when policies or source systems change. Compare it with the current process and with simpler alternatives. Rare tasks with low labor cost often fail this test. So do workflows where every output needs extensive correction, where tool calls are slow or expensive, or where a small rules based change removes most of the burden. A convincing demonstration does not establish production value because it usually omits malformed inputs, permission failures, hostile content, outages, and long term ownership. A suitable agent candidate should have enough volume or delay to matter, language or contextual variation that fixed rules handle poorly, measurable completion, containable errors, and a credible path to net value after supervision. Choose the smallest acceptable pattern Use the five gates to select among four patterns: 1. Deterministic automation when paths and rules are known. 2. AI assistant when interpretation or drafting helps but a person should decide and act. 3. Approval based agent when adaptive tool use adds value and consequential actions can receive meaningful review. 4. Bounded autonomous agent only for low consequence, reversible actions with enforced permissions, monitoring, and tested recovery. Record exclusions as deliberately as approvals. State which decisions remain human led, which tools are prohibited, which data is out of scope, and what change would trigger a new review. OpenAI's governance paper emphasizes keeping agent operations safe and accountable; an clear boundary is part of that accountability. The final question is not "Can a model do this?" It is "Is model directed action the most reliable, governable, and economical way to do it?" When any gate fails, fix the process, narrow the role, choose simpler software, or keep the work human led. Sources A practical guide to building agents https://openai.com/business/guides and resources/a practical guide to building ai agents/ AI Risk Management Framework https://www.nist.gov/itl/ai risk management framework Safety in building agents https://developers.openai.com/api/docs/guides/agent builder safety Practices for Governing Agentic AI Systems https://openai.com/index/practices for governing agentic ai systems/ Cover image credit Cover image by The White House , made available under Public domain . WIKIVISE cropped and converted the source image.