Agentic workflow integrity means being able to check that the workflow admitted for execution is the one that was evaluated, and that its transitions followed the required conditions. A successful run does not establish that chain by itself. The workflow's identity and the evidence authorizing its transitions have to remain connected.
Identify the behavior you are promoting
Source code is one input. Agent behavior also depends on the model version, instructions, tool definitions, retrieval configuration and runtime settings. Record the relevant versions together. Where practical, use content-addressed artifacts so a later reviewer can check whether the inputs changed.
For dynamic workflows, distinguish the version of the planner from the graph it produced. Record the executable graph and its admitted environment separately. Freezing a graph does not make its external dependencies deterministic.
Bind approval to a specific candidate
Evaluate a candidate configuration, attach the results to that candidate and make the promotion decision reference both. If a tool definition or prompt changes after evaluation, the prior result cannot silently authorize the changed behavior. Define which changes require a new evaluation and who can approve exceptions.
Illustrative promotion chain:
behavior manifest → evaluation evidence → approval → deployed manifest
compare identity at each transition; stop on mismatch
My research on justifiability studies this binding problem in public delivery records. The Agent Graph Runtime provides a separate model for construction, qualification, admission and execution. They inform the design; neither publication certifies a specific deployment.
Preserve integrity during execution
Make state transitions explicit. A queued action, an attempted action and a completed action are different states. Use idempotency for retries, validate prerequisites before consequential steps and keep evidence of both success and refusal. Recovery should resume from durable state rather than asking a model to guess how far the previous run got.
External content can contain instructions. Treat it as data with a source, not as authority to change the workflow's permissions. An approval must remain tied to the operation approved.
Test the chain where it can break
Change a prompt after evaluation and verify promotion refuses the mismatch. Repeat a write and verify it is not duplicated. Interrupt a run between steps and check the recovery path. Remove required evidence and verify the transition remains blocked. Those negative controls establish that the controls affect execution.
When reviewing an engineer's work, ask for the candidate manifest, evaluation result and deployed identity from one real change. The sources below describe my evaluation and workflow research, including what each can and cannot establish.