Use the Least Dynamic AI Pattern That Can Complete the Work

Use the least dynamic artificial intelligence (AI) pattern that can complete the work within its acceptance and authority boundary. A single call, fixed chain, router, parallel fan-out, orchestrator, and evaluator loop each add different discretion and failure burden. An agent is a harnessed system that chooses process or tools at runtime; its value comes from workload fit rather than maturity. Start from the path the workload actually requires, compare it with the simplest eligible baseline, and grant only the actions supported by end-to-end evidence, external verification, bounded budgets, and tested recovery.

Pattern choice is a control decision

A model call transforms supplied context into a proposal. A workflow determines which steps occur. An agent may choose steps at runtime. As discretion grows, the system must manage more state, branches, permissions, failure semantics, evaluation, cost, and recovery.

The ReAct paper studies a pattern that interleaves reasoning and actions in specified tasks. Its method and results stay inside those tasks and grant no generic operating permission. Vendor-authored guidance on building effective agents also distinguishes workflows with predefined paths from agents whose processes and tool use emerge dynamically.

The executive question is: “What runtime discretion is necessary, and what additional evidence does that discretion require?”

Select directly from six patterns

One bounded call fits transformation, extraction, classification, or drafting when direct checks can determine acceptance. It has the smallest state and recovery surface, though input handling and output validation still matter.

A fixed chain fits known stages with explicit intermediate contracts. Validate each handoff. A chain can locate failures clearly, but one silent error can propagate if downstream steps trust it automatically.

Routing fits qualified categories that need different prompts, models, tools, or execution paths. Test the classifier, unknown class, fallback, and cross-route consistency. Routing creates value only when cohort differences exceed its error and operating burden.

Parallel fan-out and synthesis fits independent evidence gathering or candidate generation. Define which tasks may run concurrently, how duplicates and conflicts are handled, and what rule produces the final result. Parallelism can multiply cost and correlated error.

Orchestrator and workers fit work where useful subtasks emerge during execution but remain inside one goal and acceptance contract. The orchestrator may decompose and assign work inside that fixed mandate.

Evaluator and optimizer fit iterative improvement only when an external rubric can distinguish better from worse. The evaluator needs calibration, stop rules, and a maximum retry budget. Self-critique by the same model can repeat the same blind spot.

Open-ended action beyond these bounds carries the highest uncertainty and authority burden. Reserve it for an explicit outside-playbook decision.

Put a harness around every dynamic path

The harness makes the model pattern operable. It needs:

• a goal contract with deliverables, non-goals, evidence, deadline, risk class, budget, and stop conditions;
• structured state and checkpoints that make work inspectable and restartable;
• context construction that ranks evidence, applies access rules, and limits growth;
• typed tools with schemas, constrained parameters, timeouts, idempotency, and output limits;
• a permission broker that binds a real identity to the smallest resource and operation;
• external verification, human escalation, traces, incident handling, and recovery.

The OWASP excessive-agency guidance identifies excessive functionality, permissions, and autonomy as root causes and recommends narrowing them, using downstream authorization, and adding user approval for high-impact actions. Treat it as a threat lens; sufficiency still requires workload evidence.

Planning exposes work; policy authorizes it

A bounded dynamic loop can use this state machine:

1. Validate the goal, owner, acceptance, scope, and budget.
2. Propose a plan with dependencies, assumptions, permissions, and tests.
3. Check policy before each consequential action.
4. Execute one bounded, preferably reversible unit.
5. Persist structured state and observe the result.
6. Verify against evidence outside the proposing loop.
7. Complete, repair within budget, escalate, or stop.

New evidence may change the plan inside the existing mandate. Scope expansion routes to accountable authorization. A missing permission routes to accountable escalation. A denied tool call is a control result rather than a prompt-rewriting challenge.

Make external mutations idempotent or duplicate-detecting. Save state before side effects. Define compensation where reversal is impossible. Stop on severe failure, deadline, exhausted budget, repeated no progress, missing owner, or invalidated evidence.

Grant authority one action boundary at a time

Autonomy describes permitted action rather than intelligence. A useful operating ladder is:

• A0: generate. The system drafts, summarizes, or classifies inside a named source boundary for accountable review.
• A1: read. It uses approved retrieval or read-only systems with caller access control, provenance, and injection tests.
• A2: propose. It presents plans, calls, transactions, or changes in preview with typed validation, a visible diff, and authenticated approval.
• A3: execute a reversible action. The exact resource, operation, population, limits, monitoring, and rollback have passed.
• A4: execute consequential bounded work. Independent verification, segregation, recourse, containment, and dual restart are required for the exact mandate.
• A5: open-ended or irreversible authority. Prohibited by default, independent of model capability or company size.

The 2026 NIST concept paper on software and AI agent identity and authorization is an initial public draft focused on identification, authorization, and auditing questions. It helps frame controls while leaving this ladder as IMPAKT synthesis.

Build the pattern-and-authority contract

Record the selected pattern, why each simpler eligible baseline failed, and the exact discretion added. Then name state, context, tools, identities, permissions, evaluator, budgets, stops, recovery, release owner, incident stop right, and restart authority.

Evaluation must exercise the complete pattern. Include ordinary, difficult, invalid, tool-error, redirection, and severe cases. Measure accepted completion, interventions, retries, loops, latency, cost, duplicate effects, state corruption, escalation, and recovery. Repeated evidence across those cases qualifies the boundary.

Demote when complexity stops improving accepted outcomes or when its failure, cost, or recovery burden exceeds value. A workflow can move from orchestrator to fixed chain after the path stabilizes. Simplification is operating learning rather than regression.

Synthetic worked workload — customer address change. Workload CUST-ADDR-01 reads an authenticated request, validates a new postal address, shows the proposed account diff, obtains approval, and submits one idempotent change. The route is known, so a fixed chain at A2 Propose is the starting pattern; an orchestrator adds discretion without adding useful work. Measure accepted changes, rejected validations, duplicate effects, approval time in minutes, recovery success, and cost per accepted change. A3 Execute reversible becomes eligible only after repeated end-to-end cases support the exact account field, population, rollback, and stop conditions. The production-readiness gate then qualifies release, while the evaluation-oracle article defines regression and rollback evidence. This example grants no authority over payments, identity changes, or irreversible account actions.

Decision rule

Choose the lowest-discretion eligible pattern that meets acceptance. Let planning expose work, policy authorize it, and external verification end it. Grant the least authority that completes the workload and promote only the exact boundary supported by new evidence.

What this does not prove

This article does not claim that one pattern or autonomy level is safe, production-ready, or appropriate across workloads. The ladder is an IMPAKT operating synthesis, not a standard. Cited papers and guidance do not establish reliability, security, compliance, or business value for an untested agent system.

Editorial process

This article was extracted from the IMPAKT LLM Operating Playbook with AI-assisted structure, drafting, editing, and metadata preparation. It underwent an independent critique and substantive revision loop against IMPAKT's publication rubric; primary sources are linked beside supported claims, and synthesis, recommendations, and evidence boundaries remain explicit.

Sources

• Yao et al., ReAct, submitted October 6, 2022; accessed August 29, 2026.
• Anthropic, Building Effective Agents, December 19, 2024; accessed August 29, 2026. Vendor-authored guidance, not independent validation.
• OWASP, LLM06: Excessive Agency, project page; accessed August 29, 2026.
• NIST, Accelerating the Adoption of Software and AI Agent Identity and Authorization, initial public draft, February 5, 2026; accessed August 29, 2026.