Practitioner guide · v1.1

Agent patterns: eighteen ways to build an AI agent, the controls each one needs and the evidence that proves them

By Richard White · Version 1.1 · 11 November 2026

Read online Download the PDF (19 pages, 0.2 MB) Discuss it in a working session

Free, no form.

Abstract

Most lists of agent types mix five different things: how an agent decides, how agents are organized, what capabilities are added, where the agent acts and how much it may do without a person. This guide separates them, so any agent can be described with one choice from each.

It sets out eighteen patterns in four groups, from agentic workflows and routers to orchestrator-worker teams, agentic retrieval, coding, browser, voice and data agents. Each comes with when to use it, when not to, the representative tools as of November 2026, the main risk, the minimum controls and examples from 100 AI Use Cases and Who Runs Them.

A five-level autonomy scale, from assist to bounded autonomy, treats autonomy as a setting chosen per action rather than a kind of agent. For banks, it maps each pattern and autonomy level to the questions in the OCC’s November 2026 examiner framework; for insurers, to the NAIC model bulletin; and for growth companies, to what customers and investors ask. Twenty-two controls each have an owner in every line of defense and the evidence that proves them.

The builder below turns your choices into a release pack: a risk view, a draft purpose statement and the controls and evidence for one agent, to download as a Word file.

The eighteen patterns

Find the simplest pattern that does the job.

01 Control pattern Start at L3

Rules-based automation

Baseline, not an agent

Fixed triggers and rules. No model reasoning, no memory.

When to use it, tools and controls

Best for: High-volume, stable, fully specified tasks.
Avoid when: Inputs are unstructured or the rules keep multiplying.
Representative tools: Zapier, n8n, Power Automate, IFTTT. All now offer AI steps; adding one turns the flow into an agentic workflow.
Main risk: Silent breakage when an upstream format changes.
Minimum controls: Change control and run monitoring, as for any integration.
In the 100 Use Cases: Routing or acknowledging email. None of the 100 use cases is pure rules.

02 Control pattern Start at L2

Agentic workflow

Model steps on a fixed path

Code fixes the sequence; a model performs named steps such as extract, classify or draft.

When to use it, tools and controls

Best for

Repeatable processes with unstructured inputs. Where most production value sits today.

Avoid when

The path genuinely cannot be known in advance.

Representative tools

LangGraph; Microsoft Agent Framework workflows (1.0 GA, April 2026); Gemini Enterprise Agent Designer; n8n and Zapier AI steps.

Main risk

Step-level errors compound along the chain.

Minimum controls

Evaluation set per step; schema-validated outputs; a person on the consequential step.

In the 100 Use Cases

#4 Commercial submission intake & triage Zurich Insurance Group
#3 GenAI claims correspondence drafting Allstate

03 Control pattern Start at L2

Router (triage) agent

Sends each request to the right path

Classifies each request and hands it to the right workflow, agent or person.

When to use it, tools and controls

Best for

Front doors with many request types.

Avoid when

There is only one path.

Representative tools

OpenAI Agents SDK handoffs; LangGraph conditional edges; Google ADK.

Main risk

Misroutes stay invisible unless measured.

Minimum controls

Confusion-matrix testing; a low-confidence default route to a person.

In the 100 Use Cases

#84 Correspondence triage for vulnerable claimants UK Department for Work and Pensions

04 Control pattern Start at L1

Tool-using agent

Single-agent loop

The model loops: reason, call a tool, read the result, repeat until done.

When to use it, tools and controls

Best for

Open-ended tasks across a few systems.

Avoid when

Tools are unreliable, or a write cannot be undone.

Representative tools

Claude Agent SDK; OpenAI Agents SDK; Google ADK; AWS Strands Agents. Tools exposed through MCP.

Main risk

Tool misuse; prompt injection arriving in tool results.

Minimum controls

Least-privilege tool scopes; approval bound to the exact action; idempotent writes; full trace.

In the 100 Use Cases

#20 Agentic sales assistant for auto finance Capital One

05 Control pattern Start at L1

Planner-executor

Long-horizon, including deep research

Writes a plan, executes it step by step and revises as results arrive. Runs minutes to hours. Includes deep research agents.

When to use it, tools and controls

Best for

Multi-step goals with checkpoints: research, compliance packs, migrations.

Avoid when

A one-step answer will do, or latency and cost matter more than depth.

Representative tools

ChatGPT Work plan mode (launched July 2026); Claude Managed Agents (public beta); OpenAI, Gemini and Claude deep research; LangGraph.

Main risk

Drift from the goal; runaway token cost.

Minimum controls

Plan approval before execution; step and budget limits; resumable checkpoints.

In the 100 Use Cases

#98 Agentic tax compliance EY

06 Control pattern Start at L0

Evaluator-optimizer

Draft, critique, revise

One model drafts; a second pass critiques against a rubric; the draft is revised until it passes.

When to use it, tools and controls

Best for

Quality-sensitive writing and code where a rubric exists.

Avoid when

There is no objective rubric, or the critic shares the drafter's blind spots.

Representative tools

Reflexion and Self-Refine (research techniques); LangGraph loops; model-graded evaluators in evaluation tools.

Main risk

Self-agreement mistaken for correctness.

Minimum controls

Calibrate the critic against human-graded examples; cap iterations.

In the 100 Use Cases

#45 Clinical/regulatory document drafting Novo Nordisk

07 Topology Start at L1

Orchestrator-worker

Hierarchical

A lead agent splits the goal, delegates to specialist subagents with their own context and tools, then assembles the result.

When to use it, tools and controls

Best for

Broad tasks that divide cleanly into parallel parts.

Avoid when

Subtasks are tightly coupled, or delegation adds nothing.

Representative tools

Claude Agent SDK subagents; Microsoft Agent Framework Magentic pattern (GA); CrewAI hierarchical process; Google ADK.

Main risk

Context lost at hand-offs; cost multiplies with each worker.

Minimum controls

Typed hand-off contracts; no worker holds wider permissions than the lead; one trace across agents.

In the 100 Use Cases

#93 M&A due diligence review GSK Stockmann

08 Topology Start at L1

Peer hand-off team

Specialists pass work by role

Specialist agents pass work to one another by role, with no single manager.

When to use it, tools and controls

Best for

Pipelines of distinct skills: researcher, drafter, reviewer.

Avoid when

The task is small enough for one agent to hold.

Representative tools

OpenAI Agents SDK handoffs; CrewAI; Microsoft Agent Framework sequential and parallel patterns (AutoGen is now in maintenance mode).

Main risk

Loops; unclear accountability for the outcome.

Minimum controls

A named owner for the outcome; termination conditions; a shared trace ID.

In the 100 Use Cases

#91 Contract drafting and review A&O Shearman

09 Topology Start at L1

Cross-organization agents

Agent-to-agent across firms

Agents from different vendors or firms discover each other and exchange tasks over a protocol.

When to use it, tools and controls

Best for: Partner, supply-chain and payment workflows.
Avoid when: Counterparty identity and liability are not contracted.
Representative tools: A2A protocol (an Agentic AI Foundation project since August 2026); Agent Payments Protocol (AP2); agent registries and gateways.
Main risk: Impersonation; data leaving the boundary.
Minimum controls: Agent identity and signed requests; contracted scopes; data-sharing rules enforced at the gateway.
In the 100 Use Cases: Emerging. None of the 100 use cases is yet cross-firm.

10 Capability modules Start at L0

Agentic retrieval

Agentic RAG

The agent decides what to search, retrieves, checks relevance and searches again before answering with citations.

When to use it, tools and controls

Best for

Answers that depend on current or internal documents.

Avoid when

The corpus is ungoverned, or built-in knowledge is enough.

Representative tools

LlamaIndex; LangChain; Snowflake Cortex Search; Databricks AI Search; Azure AI Search; Gemini Enterprise.

Main risk

Retrieval exposes content the user is not entitled to see; stale sources.

Minimum controls

Enforce the caller's entitlements at retrieval, not in the prompt; show source dates and citations.

In the 100 Use Cases

#16 Research Q&A assistant (capital markets) Morgan Stanley
#96 Accounting standards research assistant Deloitte

11 Capability modules Start at L0

Memory

Continuity across sessions

Stores facts, preferences and past outcomes across sessions and recalls them when relevant.

When to use it, tools and controls

Best for

Assistants with ongoing relationships or long-running cases.

Avoid when

Tasks are one-off, or retention rules forbid storage.

Representative tools

Letta; Mem0; Zep; LangMem; managed memory in AWS Bedrock AgentCore and Claude Managed Agents (research preview).

Main risk

Privacy breach; stale or poisoned memories.

Minimum controls

Retention and deletion policy; provenance on each memory; users can view and erase.

In the 100 Use Cases

#15 Advisor meeting notes & follow-up (wealth) Morgan Stanley Wealth Management

12 Capability modules Start at L2

Learning (optimization)

Improves from graded feedback

Performance improves from graded feedback, mostly offline: prompt optimization, fine-tuning, refreshed examples. Runtime self-modification is rare in production.

When to use it, tools and controls

Best for

High-volume tasks with a clear success signal.

Avoid when

Behavior must stay stable and auditable between releases.

Representative tools

DSPy; OpenAI reinforcement fine-tuning; evaluation-driven prompt optimization.

Main risk

Drift; reward hacking; untested behavior reaching production.

Minimum controls

Every learned change ships as a new release, tested and approved like code.

In the 100 Use Cases

#3 GenAI claims correspondence drafting Allstate

13 Environment Start at L1

Coding agent

Repositories, tests, pull requests

Reads a repository, writes and runs code and tests, and opens changes for review.

When to use it, tools and controls

Best for

Software delivery, legacy modernization, data pipelines.

Avoid when

There are no tests, no sandbox and no reviewer.

Representative tools

Claude Code; OpenAI Codex (now inside the ChatGPT desktop app); GitHub Copilot coding agent; Cursor; Devin.

Main risk

Plausible but wrong code; secrets exposure.

Minimum controls

Sandboxed execution; mandatory review and CI gates; no production credentials.

In the 100 Use Cases

#17 Legacy code modernization (AI software agents) Goldman Sachs

14 Environment Start at L1

Browser agent

Navigates sites and forms

Navigates sites, reads pages, fills forms and clicks through flows.

When to use it, tools and controls

Best for: Web research, monitoring, portals with no API.
Avoid when: An API exists, or the pages hold sensitive data under the user's sign-in.
Representative tools: Perplexity Comet and Comet Enterprise (March 2026); ChatGPT Work's built-in browser; Claude in Chrome; Browser Use (open source). ChatGPT Atlas was discontinued on 9 August 2026.
Main risk: Indirect prompt injection from page content.
Minimum controls: Site allow-lists; signed-out mode by default; confirmation before any submit or purchase.
In the 100 Use Cases: Competitor and regulatory monitoring; portal submissions where no API exists.

15 Environment Start at L1

Computer-use agent

Drives desktop applications

Sees the screen and drives mouse and keyboard in desktop applications.

When to use it, tools and controls

Best for: Legacy desktop software with no API; replacing brittle RPA scripts.
Avoid when: An API or browser route exists, or the system is high-risk.
Representative tools: Claude computer use tool; computer use inside ChatGPT Work; Gemini computer use; RPA vendors such as UiPath adding agents.
Main risk: Slow and error-prone, with a wide blast radius.
Minimum controls: Dedicated virtual machine and account; session recording; human takeover.
In the 100 Use Cases: Back-office re-keying between legacy screens.

16 Environment Start at L2

Voice agent

Real-time conversation

Speech in, speech out, with tool calls, in a live conversation.

When to use it, tools and controls

Best for

Contact centers, intake, scheduling, outreach.

Avoid when

Conversations are complex, emotional or regulated advice.

Representative tools

OpenAI Realtime API; Azure Voice Live API (GA); Gemini Live API; ElevenLabs; contact-center platforms.

Main risk

Errors happen live; containment targets can hurt customers.

Minimum controls

Warm transfer to a person; recording and QA sampling; disclosure that the caller is speaking with AI.

In the 100 Use Cases

#1 Voice AI claim intake (FNOL) Travelers
#40 Voice AI for patient access and outreach WellSpan Health

17 Environment Start at L0

Data and analytics agent

Governed questions over a semantic layer

Turns a business question into a governed query over a semantic layer, runs it in the database and returns the answer with its definition and date.

When to use it, tools and controls

Best for

Self-service metrics; finance and risk questions.

Avoid when

Definitions are not agreed, or a causal question is asked of descriptive data.

Representative tools

Snowflake Cortex Analyst; Databricks Genie; dbt Semantic Layer; Looker with Gemini; Microsoft Fabric data agents.

Main risk

Confident wrong numbers from ambiguous definitions.

Minimum controls

Verified query repository; row and column security enforced in the engine; every answer shows definition, source and date.

In the 100 Use Cases

#55 Demand forecasting at scale Target
#68 Demand forecasting and S&OP Kraft Heinz

18 Environment Start at L2

Ambient (event-driven) agent

Runs in the background

Runs in the background on a trigger or schedule, with no prompt, then reports or acts.

When to use it, tools and controls

Best for

Monitoring, queue work, overnight preparation.

Avoid when

Nobody owns the output.

Representative tools

ChatGPT Work scheduled tasks; Claude Managed Agents; AWS Bedrock AgentCore (GA); Microsoft Foundry Hosted Agents (GA).

Main risk

Unseen actions; spend that runs while no one watches.

Minimum controls

Agent identity in IAM; run logs; budget caps; kill switch.

In the 100 Use Cases

#78 Interconnection queue processing PJM Interconnection

Tool lists are representative, not endorsements. Statuses as published by each vendor on 11 November 2026. Use-case examples are the author’s classification, not claims about how each organization built its system.

Three lines and evidence

Twenty-two controls, who owns them and what proves they work.

The builder above selects the controls that apply to your agent. This is the full catalog in bank and insurer terms: the first line runs each control, the second line sets the standard and challenges it, and internal audit tests it.

Show all twenty-two controls

Control	First line	Second line	Third line	Evidence	How often
Purpose statement and permitted use	Business owner writes it and keeps it current	Approves the scope and checks use stays inside it	Tests that actual use matches the approved purpose	Approved, versioned purpose statement, including who may invoke the agent	Before release; on any change of scope
Named owner and inventory entry	A named owner accountable for outcomes, with authority to stop the agent	Confirms the owner has the authority and capacity	Checks the inventory is complete and current	AI inventory entry with owner, tier, status and providers	Quarterly
Risk tier and consequence classification	Proposes the tier from consequence, autonomy and oversight	Challenges and sets the tier	Tests tiering consistency across the inventory	Tier record with rationale and approver	Before release; on any change
Agent identity and least-privilege tool scopes	Gives the agent its own identity and the narrowest tool scopes	Sets the access standard and approves any elevated scope	Samples actual access against the manifest	Agent manifest (identity, tools, scopes) and periodic access review sign-off	Every release; quarterly review
Data entitlements enforced at the source	Enforces the caller's permissions at the data source or engine, not in the prompt	Defines data classification and permitted uses	Re-performs allowed and denied requests	Entitlement test results with allowed and denied cases	Every release
Approved business meaning	Data owners approve the definitions the agent relies on	Checks the definitions used in regulated outputs	Traces an output back to approved definitions	Versioned glossary or ontology release with owner approvals	Each release of definitions
Evaluation gate before release	Builds and runs the evaluation set; release is blocked below threshold	Approves thresholds and reviews results for higher tiers	Confirms the gate ran and could not be bypassed	Signed evaluation report per release, with thresholds and results	Every release
Independent validation	Supplies documentation and test access	Validates independently of the builders	Reviews validation coverage and independence	Independent validation report and findings log	Before release; annually or on material change
Approval bound to the exact action	Reviewers approve the exact proposed action before it runs	Defines which actions need approval	Re-performs a sample of approvals	Approval log: reviewer, exact proposal, time, expiry and outcome	Every consequential action
Meaningful human review	Staffs review so each reviewer has the information, time and authority to say no	Monitors override and approval rates for rubber-stamping	Tests whether review is meaningful, not a nominal click	Review volume per reviewer, override rates and reviewer training records	Monthly
Monitoring, sampling and alerting	Monitors outcomes, samples results and responds to alerts	Sets sampling rates and alert thresholds	Checks alerts were raised and resolved	Monitoring dashboard, sampling log, and alert and incident tickets	Continuous; monthly review
Hard limits on spend, scope and rate	Configures spend, scope, rate and data limits	Approves the limits	Tests that a breach is blocked	Configured limits and a breach test record	Every release
Kill switch and fallback operation	Can stop the agent quickly and keep the process running without it	Sets the triggers for suspension	Reviews the drill and the time to stop	Kill-switch drill record with time to stop, and the fallback runbook	Quarterly drill
Request reconstruction	Records each request: inputs, sources, tools, outputs and approvals	Defines what must be kept and for how long	Rebuilds one allowed, one denied and one corrected request	Evidence index and request traces	On demand; tested annually
Change control for prompts, models and tools	Versions prompts, models, tools and learned changes, and ships them as releases	Reviews material changes	Tests that production matches an approved release	Release record listing every component version	Every change
Model and tool provider oversight	Performs due diligence on providers and tracks their model changes	Approves providers and contract terms	Reviews provider oversight	Provider due diligence file and contract terms on data use, notice of model changes and audit	At onboarding; annually
Prompt injection and unsafe content testing	Tests injection and unsafe content through every input path	Sets the test scope	Checks testing covered every path	Red-team and injection test results	Every release
Customer disclosure and complaint handling	Tells customers they are dealing with AI and routes complaints to a person	Reviews disclosures and complaint trends	Samples complaints end to end	Disclosure text, complaint log and resolutions	Ongoing; monthly review
Fair outcome testing	Tests outcomes across customer groups before and after release	Sets fairness tests and reviews results (fair lending; unfair discrimination)	Re-performs a test	Outcome testing results and remediation	Before release; quarterly
Typed hand-offs between agents	Defines typed hand-offs; no worker holds wider permissions than the lead	Approves cross-agent permissions	Traces one task across every agent	Hand-off schemas, tests and a cross-agent trace	Every release
Memory retention and deletion	Applies retention and deletion; users can view and erase	Sets the retention rules	Tests deletion end to end	Retention configuration and a deletion test	Every release; annually
Cost per accepted task	Tracks cost per accepted task against the baseline	Finance reviews it against the business case	Checks benefit claims are supported	Monthly cost-per-accepted-task report	Monthly

Autonomy

Autonomy is a setting, not a type of agent.

Any pattern can run at any level. Set the level per action, from the consequence of the action and the evidence that the agent does it reliably.

Level	The agent	The person	Use when	Minimum oversight
L0 Assist	Suggests, drafts or answers.	Decides and acts.	Any new use case; anything touching people's rights or money.	Output review by the user; usage logging.
L1 Approve each	Proposes every action.	Approves each action before it runs.	Early production; high-consequence actions.	Approval bound to the exact proposal, with expiry.
L2 Approve the consequential	Acts on low-risk steps; stops before money, customer or record changes.	Approves the consequential step.	Most regulated workflows today.	Consequence tiers defined per action; a reviewer with the information, time and authority to say no.
L3 Monitor	Acts within bounds.	Reviews samples, exceptions and metrics.	Proven, reversible, high-volume work.	Sampling plan; alerting; fast rollback.
L4 Bounded autonomy	Runs end to end within contracted limits.	Owns the outcome and reviews performance.	Low-consequence work with strong evidence.	Hard limits on spend, scope and data; kill switch; periodic re-approval.

Decision it supports

Which agent pattern a workflow needs, at what autonomy level, and which controls and evidence must exist before release.

What you will produce

A release pack for one agent: risk view, purpose statement, and each control with its three-lines owners and evidence.

See it worked through in a guide

Claims package 1.1.0 · 26 October 2026. Synthetic worked example: team A, group disability, region 2. Read-only preparation of the assigned case; examiners retain every case decision. Hold candidate 1.0.0 after an unrelated employee’s claim is returned. In the synthetic decision, accept 1.1.0 for a monitored team A rollout only after prior-claims history is disabled and the remaining scope passes a fresh evaluation. All figures, evidence and sign-offs in that guide are invented; the paper provides the underlying method.

In the paper

Three passages, as published

Control

Choose the highest row that does the job.

Environment

Prefer an API whenever one exists.

Choosing

Most failed agent projects chose too much agency too early.

Keep reading

Discuss this paper against your own program.

A free sixty-minute working session with Richard on your top gaps. You leave with a one-page summary within three business days, and three next questions.

Request a working session Take the 5-minute diagnostic

Agent patterns: eighteen ways to build an AI agent, the controls each one needs and the evidence that proves them

Describe your agent. Get its release pack.

What you will need to show before this agent goes live.

Draft purpose statement

Who does what

Controls, owners and the evidence that proves them

Take it with you

Find the simplest pattern that does the job.

Rules-based automation

Agentic workflow

Router (triage) agent

Tool-using agent

Planner-executor

Evaluator-optimizer

Orchestrator-worker

Peer hand-off team

Cross-organization agents

Agentic retrieval

Memory

Learning (optimization)

Coding agent

Browser agent

Computer-use agent

Voice agent

Data and analytics agent

Ambient (event-driven) agent

Twenty-two controls, who owns them and what proves they work.

Autonomy is a setting, not a type of agent.

Three passages, as published

Read next

Subscribe to whitepapers and updates

Discuss this paper against your own program.