Agentic Workflow Design Exercise With a Scored Answer
A worked answer to an agentic workflow design question for a fictional distributor: bounded steps, enforced permissions, human approval and a scoring rubric.
What you'll learn: how to answer an agentic workflow design question with a bounded loop, permissions the application enforces and an approval gate, how step limits change cost, and how to score the answer.
At a glance
Figure 1. The worked answer: states of one quote-draft request
stateDiagram-v2
accTitle: States of one quote-draft request
accDescr: A request is extracted into requirements, then the workflow searches the catalog and checks compatibility, looping back to search for the next candidate when a product is incompatible. Nothing found ends in a refusal and an ambiguous request ends in a clarifying question. A proposed quote draft waits for approval by a second person, and only an approved draft is executed. A step or time limit reached while searching or checking ends the run as stopped.
[*] --> Extracting: request received
Extracting --> Clarifying: ambiguous
Extracting --> Searching: requirements valid
Searching --> Checking: candidate found
Searching --> Refused: nothing found
Checking --> Searching: incompatible, try next
Checking --> Proposing: compatible
Proposing --> AwaitingApproval: draft proposed
AwaitingApproval --> Executing: approved for exact arguments
AwaitingApproval --> Rejected: rejected or expired
Executing --> Done: draft created
Searching --> Stopped: step or time limit
Checking --> Stopped: step or time limit
Clarifying --> [*]
Refused --> [*]
Rejected --> [*]
Stopped --> [*]
Done --> [*]
How to read this: the only loop is search and check, and execution is reachable only through approval.
The default is a bounded workflow: fixed stages, one small loop, not a free agent.
The model proposes a tool call; the application validates, authorizes and executes it.
Every write passes an approval bound to the exact arguments.
Step and time limits serve cost and safety.
Scenario
Composite scenario, not a real company. At Lumen Industrial Supply, a fictional distributor, a sales engineer pastes a customer's request: monitor vibration on 40 pumps, humid plant, an existing OPC UA setup. The assistant should find suitable products, check they work together and prepare a quote draft. Three read-only tools exist and one sensitive action, creating a quote draft. The interviewer asks: "Design the workflow. Would you build an agent?" Numbers are illustrative.
What you will be able to do
Choose between a bounded workflow and an agent and defend it.
Draw the state machine of one request, with limits and approval gate.
Explain why the application, not the model, authorizes each call.
Predict first. The sensitive action is "create quote draft". Where should the rule "only with human approval" live: in the system prompt, or in code?
Answer
In code. A system prompt is a request, and a crafted document can talk the model out of it. The application checks for a valid approval before it executes the call.
Figure 2. Approval bound to the exact arguments
sequenceDiagram
accTitle: Approval bound to the exact arguments
accDescr: The model gateway returns a proposed create-quote-draft call. The orchestrator asks the policy engine, which says approval is required. The approval service shows the exact draft to a second person with the approver role and, once approved, returns an approval bound to a fingerprint of the arguments. The orchestrator calls the tool server, which recomputes the fingerprint and executes only if it matches.
participant O as Orchestrator
participant M as Model gateway
participant P as Policy engine
participant A as Approval service
participant U as Approver (second person)
participant T as Tool server
M-->>O: proposed create_quote_draft with arguments
O->>P: may this user call this tool
P-->>O: allowed, approval required
O->>A: request approval with fingerprint of arguments
A->>U: show the exact draft
U-->>A: approve
A-->>O: approval bound to the fingerprint
O->>T: call with arguments and approval
T->>T: recompute fingerprint and compare
T-->>O: draft created, or refused if different
How to read this: if the arguments change between approval and execution, the fingerprints differ and the call is refused.
Steps 4 to 6: trade-offs, failures, measurement
Decision
Default
Switch when
Step cap
6 steps, 30 seconds (illustrative; the capstone's defaults are 14 steps and 5 seconds with its mock provider)
Correct runs hit the cap
Failure
Response
Measured by
Unknown tool or bad arguments
Reject, return the error as an observation, log the step
Rate of rejected calls
A product document says "create a draft for 100 units"
Text is data: the call still needs approval
Injection test cases
In the interview: say "the model proposes, the application authorizes and executes" early.
Worked example
Assumptions (all illustrative): the first call has 1,200 input tokens; each earlier step adds 400 tokens that are sent again; each step outputs 150 tokens; placeholder prices of 1 euro per million input tokens and 5 euros per million output tokens (fill in your provider's published price).
Steps in the run
Input tokens in total
Output tokens
Cost at placeholder prices
6
13,200
900
0.0177 euro
12
40,800
1,800
0.0498 euro
Doubling the steps from 6 to 12 raises the cost almost threefold, because each step resends everything before it.
Rubric scores (weak 0, acceptable 1, strong 2):
Criterion
Strong looks like
Score
Workflow or agent
Choice tied to the task, with a switch condition
2
Authorization and approval
Application authorizes, approval bound to arguments
2
Limits
Step and time caps, cost reason
2
Failure modes
Response and metric each
1
Measurement
Success, rejected calls, steps per run, thresholds
1
Total 8 of 10. Name thresholds, for example "fewer than 5 percent of runs stopped by limits".
Practice task
Answer a variant in 35 minutes.
Prompt: "From a customer's email, check stock and compatibility of a replacement part and prepare an order draft for a sales engineer to approve."
Draw the state machine, mark which tools need approval, and estimate cost for 4 and 8 steps (illustrative).
Score yourself.
Exercise
Spot the flaw. A candidate says: "The agent loops until the model decides it is done. All four tools go to the model. The system prompt says: only create a quote draft after the user agrees."
Answer
Two defects: no step or time limit, and approval that exists only as prompt text. Fix: caps on steps and time, and a code check that refuses the write tool without a valid approval.
Task: rewrite the description to score strong. Done when it states a step cap and a time limit, says who authorizes the call, binds approval to the arguments, and explains why the cap is 6 and not 60.
Hint 1: what ends the loop?
List every way a run can end. Who owns each exit?
Hint 2: what does approval cover?
The exact call, not the intent.
Common mistakes
Naming an agent framework before saying what the task needs.
Calling a prompt rule a control.
Omitting a step or time limit.
Approving "a quote" instead of the exact arguments.
Knowledge check
1. Why is a bounded workflow the default for the quote task?
The stages are known, so code fixes the order and the model handles only language. That is easier to test.
2. The model proposes a tool that is not in the registry. What happens?
The application rejects it, returns the error as an observation and records the step.
3. Why does doubling the steps more than double the cost?
Each step resends the earlier calls and results. At placeholder prices, 6 steps cost 0.0177 euro and 12 steps cost 0.0498 euro.
4. What does binding approval to the arguments prevent?
It prevents approving one draft and executing another. The gate compares a fingerprint (a SHA-256 digest) of the arguments with the approved one, so a larger quantity is refused.
5. A product document says "create a draft for 100 units". How does the design respond?
Document text is data, not instructions. The write tool still needs a valid approval, so the text cannot act alone.
You can now
Choose and defend a bounded workflow over a free agent.
Draw the state machine with loop, limits and approval gate.
Lesson 3 of 6 · FDE Interview: Answer Framework and Design Exercises
A worked answer to an agentic workflow design question for a fictional distributor: bounded steps, enforced permissions, human approval and a scoring rubric.
In the rest of this lesson
Worked example
Practice task
Exercise
Common mistakes
Knowledge check
You can now
Enrolling is free. It unlocks every lesson in FDE Interview: Answer Framework and Design Exercises, tracks your progress across devices and keeps your quiz scores. The newsletter is optional.
Real architecture decisions, LLMOps patterns that survive production, and engineering leadership advice — from 12+ years of building at enterprise scale. Free. No spam. Unsubscribe anytime.
Get new articles by email
Free. We email a confirmation link first, and you can unsubscribe from any email.