Agentic workflows as distributed transactions

Decomposition, compensation and the human checkpoint

Technical Research Note. Independent research. Not peer reviewed.

Abstract

Agent workflows are usually discussed as a prompting problem. This note treats them instead as long-running distributed transactions with unreliable participants, and asks which established patterns transfer.

The result is a mechanical test for checkpoint placement. A step whose effect has a writable compensating action can be executed and reported. A step whose effect cannot be compensated is irreversible, and irreversible steps are the only ones that require a gate. This reaches the same conclusion as the human-factors argument for oversight design, from a different direction, and it has the advantage of being decidable at design time by asking a single question about each step.

The method is conceptual analysis. No data was collected, no system was measured, and the framework produced here has not been validated against an incident corpus.

Research question

If a multi-step agent workflow is modelled as a long-running distributed transaction rather than as a prompting problem, which established patterns apply, and what does that model imply about where human checkpoints belong?

A subsidiary question follows from it: does the transaction model give a design-time test for checkpoint placement, replacing the current practice of placing checkpoints by intuition about model trustworthiness?

Background

Two properties make multi-step agent workflows structurally different from single-call model use.

Compounding failure. If a workflow has n steps and each succeeds independently with probability p, and a failure at any step is unrecoverable, then end-to-end success is pⁿ. At p = 0.95 and n = 10, that is roughly 0.60. At p = 0.98 and n = 20, roughly 0.67.

This is arithmetic and not a finding, and the independence assumption is wrong in both directions. Errors correlate, because a misread instruction affects every subsequent step, which makes the real figure worse. And some steps observe and repair the output of earlier ones, which makes it better. The arithmetic is presented for its shape rather than its values: reliability that is acceptable per step becomes unacceptable per workflow, and the standard response of improving per-step reliability has to overcome an exponent.

Partial completion with visible effects. A single model call either returns or fails. A ten-step workflow can complete six steps, three of which changed the world, and then fail. The system is now in a state no code path anticipated, and there is no rollback, because the effects were external.

The second property is the one the literature has already addressed, under a different name and forty years ago.

Methodology

Conceptual analysis, meaning reasoning from stated premises toward a framework, with no data collection.

The premises are: that agent workflows exhibit compounding failure and partial completion as described above; that tool calls produce effects outside the system's transactional boundary; and that the model selecting the steps is not a reliable participant in the protocol sense, because it can propose steps that were not anticipated.

Published work is used to supply patterns and to supply counterevidence, not to establish the framework, which is this note's own construction. Where build experience appears, it is declared as practitioner observation from a single-operator sample.

Evidence

Garcia-Molina and Salem, 1987, "Sagas" (SIGMOD). The pattern this note argues is the correct frame. A long-lived transaction is decomposed into a sequence of subtransactions, each of which commits independently, and each of which is paired with a compensating transaction that semantically undoes it. If the saga cannot complete, the compensators for the completed subtransactions are run in reverse order.

Two properties of sagas matter here. Compensation is semantic rather than physical: you do not restore a prior state, you perform an action whose effect is the inverse. A refund compensates a charge; it does not erase it. And sagas explicitly relax isolation, which means intermediate states are visible to other participants and must therefore be legitimate states rather than transient ones.

Both properties describe an agent workflow precisely.

Gray, 1981, "The Transaction Concept: Virtues and Limitations". The paper that set out what transactions buy and where the model stops. Its relevance is the boundary: once effects escape the transactional system, atomicity is no longer available and must be replaced by something weaker and explicit.

Helland, 2012, "Idempotence Is Not a Medical Condition" (ACM Queue). In any system with at-least-once message delivery, correctness requires that operations be idempotent, which in practice means a caller-supplied key that lets the receiver recognise a repeat.

This is directly load-bearing for agents, because agents retry. A retry loop over a non-idempotent tool call is a duplicate-effect generator, and the duplicate is generated by the mechanism intended to improve reliability.

Hohpe and Woolf, 2003, Enterprise Integration Patterns. The distinction between orchestration, where a process manager holds the workflow state and issues each call, and choreography, where participants react to events with no central controller. The process manager pattern is what most agent frameworks implement without naming it, and the pattern's documented requirement is a durable store of process state, held outside the participants.

Yao et al., 2023, ReAct. The reason-act-observe loop, establishing the control structure in which a model interleaves reasoning with tool calls and consumes the results. The relevant property is that the step sequence is not fixed in advance, which is where the saga analogy begins to strain.

Shinn et al., 2023, Reflexion. Agents that verbally reflect on failure signals and retain the reflection in an episodic buffer showed improved success across trials on several benchmarks. Evidence that self-correction has real value when driven by an external signal.

Huang et al., 2024, "Large Language Models Cannot Self-Correct Reasoning Yet" (ICLR). The necessary counterweight, and it should be read alongside Reflexion rather than instead of it. The authors report that intrinsic self-correction, meaning revision with no external feedback, did not improve and sometimes degraded reasoning performance, and that gains reported elsewhere frequently depend on oracle information about whether the answer was wrong.

Read together, the two papers say something useful and specific: the loop works when the signal is external and real, and it does not work when the model is asked to grade itself.

Perrow, 1984, Normal Accidents. Perrow's framework classifies systems on two axes: interactive complexity, meaning the degree to which components interact in unexpected ways, and coupling, meaning how much slack exists between them. Systems that are both interactively complex and tightly coupled produce accidents that are properties of the design rather than of any operator error, and Perrow's conclusion is that in that quadrant, accidents are normal.

A dynamically composed agent workflow with external effects sits in that quadrant by construction. The design response is not better operators. It is to reduce coupling or reduce complexity.

Leveson, 2011, Engineering a Safer World. Safety modelled as a control problem rather than a reliability problem. In Leveson's STAMP framework, accidents result from inadequate enforcement of constraints on system behaviour, and safety requirements are therefore constraints enforced by controllers, not properties of components.

The implication for agents is direct and it contradicts most current practice: a safety property cannot be a property of the model. It has to be a constraint enforced by something the model does not control.

Analysis

Step granularity is a reliability decision

Decomposition is usually treated as a prompting choice. Under the transaction model it is an engineering tradeoff with a known shape.

Fine-grained steps give more failure points and a worse exponent, but each failure has a small blast radius and a precise compensator. Coarse-grained steps give a better exponent and a worse recovery story, because a single failing step may have performed several effects with no way to distinguish which completed.

The resolution the saga literature suggests: granularity should follow compensability rather than either reliability or convenience. A step should be exactly as large as the largest unit for which a single compensating action can be written.

The compensability test

This is the note's main claim, and it is a test rather than a heuristic.

For every step in a workflow that produces an external effect, attempt to write its compensating action as code. Three outcomes follow, and each maps to a different architecture.

A compensator exists and is complete. The step is reversible. Execute it, log it, and report afterwards. No gate is warranted, and adding one spends attention with no safety return.

A compensator exists and is partial. Most real cases. A sent message can be deleted but was read; a published page can be unpublished but was indexed; a charge can be refunded but appears on a statement. The residue is what the design must account for, and the appropriate control is a batch gate: group these steps, gate them once at the plan level, and make the residue visible in the plan.

No compensator can be written. The step is irreversible. Deletion without backup, an irrevocable transfer, disclosure of information, an action with legal effect. These are the only steps that require an individual gate, and they require it permanently, because the property that makes them irreversible is not a function of model quality.

The value of this test is that it is decidable at design time by a person writing code, and it does not require anyone to estimate how much the model can be trusted. It also produces the same recommendation as the human-factors literature on oversight, which arrives there by way of vigilance and automation bias. Two independent routes to the same design is worth more than either alone.

Idempotency is not optional

Given retry, every tool with an external effect needs a caller-supplied idempotency key, and the key has to be derived from the intent rather than generated per attempt. This is Helland's requirement applied unchanged.

The failure mode without it is specific and common: a tool call times out, the result is unknown, the agent retries, and the effect happens twice. The system's own reliability mechanism is the cause.

Workflow state belongs outside the conversation

The context window is a cache. It is lossy, it has a position-sensitive read profile, and it is discarded.

The process manager pattern requires durable state: which steps completed, with what parameters and what results, which compensators are outstanding, and what the current plan is. Held outside the model, readable by a human, and sufficient to resume or to compensate after a crash.

A workflow whose only record of what it did is a transcript cannot be compensated after a restart, which means it cannot be a saga, which means partial completion is permanent.

Verification must be external

The Reflexion and Huang et al. pair gives a clean rule. Self-critique in a loop with a real external signal improves outcomes. Self-critique with no external signal does not, and may make things worse.

So the verification step in an agent workflow has to be something other than the model's own judgement: a test suite that runs, a schema that validates, a checksum, a second system with independent failure modes, or a person. A workflow whose quality gate is the model reviewing its own output has no gate.

Containment, not correctness

Perrow and Leveson together argue the most uncomfortable conclusion in this note. In an interactively complex, tightly coupled system, failures are a design property, and the response is structural.

Reducing coupling means slack: staging areas, dry runs, delays before irreversible effects, and steps that write proposals rather than results.

Reducing complexity means fewer dynamic paths: a bounded tool set per task rather than a general one, and explicit step limits.

And Leveson's control framing gives the strongest single design rule available: the agent should not hold the credential that permits an uncompensable action. The constraint is enforced by a controller outside the agent, which the agent cannot instruct, persuade or modify. This is a permissions architecture rather than a prompting practice, and it is the only form of the constraint that survives an adversarial or malfunctioning model.

Findings

Compounding failure means per-step reliability improvements fight an exponent. Reducing step count and containing partial completion are the higher-leverage moves.
Agent workflows are long-running distributed transactions with external effects, and the saga pattern from 1987 addresses their central problem.
Compensability, tested by attempting to write the compensating action, gives a design-time test for checkpoint placement: reversible steps run and report, partially compensable steps batch behind a plan gate, uncompensable steps gate individually and permanently.
Step granularity should follow compensability rather than reliability or convenience.
Retry plus non-idempotent tools produces duplicate effects. Idempotency keys derived from intent are a requirement, not an optimisation.
Workflow state must be durable and external to the model context, or partial completion cannot be recovered.
Self-verification without an external signal is not a quality gate. The published evidence for self-correction depends on external feedback.
Safety properties cannot be properties of the model. They are constraints enforced by a controller the model does not control, which in practice means the agent must not hold credentials for uncompensable actions.

Limitations

The saga analogy has a real disanalogy and it is load-bearing. Sagas assume a known, finite set of subtransactions with compensators written in advance. An agent composes its step sequence dynamically and can propose a step nobody anticipated, for which no compensator exists. This is not a minor gap. It means the saga model applies cleanly only to workflows with a bounded, pre-declared tool set, and that constraining agents to such a tool set is a precondition for the framework rather than a recommendation within it. A genuinely open-ended agent is not a saga and this note does not know what it is.

Conceptual analysis produces frameworks, not evidence. Nothing here has been validated. The compensability test has not been applied to a corpus of real incidents to see whether it would have predicted them, and until it has, its status is that of a plausible design heuristic.

The reliability arithmetic is illustrative and its independence assumption is false. It is included to show a shape. It should not be used to estimate any real workflow's success rate.

Perrow and Leveson come from a different risk domain. Nuclear plants, chemical processing and aviation have consequences, regulators and trained operators that consumer software does not. The structural argument is what transfers. Nothing about the magnitude of risk transfers, and importing the vocabulary of catastrophic-risk engineering into product design risks a false sense of rigour.

The self-correction evidence is contested and recent. Both Reflexion and its critique are benchmark studies on specific model generations and specific tasks. The rule extracted from them, that external signals help and self-grading does not, is a reasonable reading of two papers, not a settled result.

None of this is demonstrated in the author's own work. The practitioner observation available is that of a daily user of agentic coding tools and of workflow automation, which is a single-operator sample and is not evidence. No project in the author's record implements idempotency keys on tool calls, durable external workflow state, or a permissions boundary that withholds credentials from the agent. The framework is derived from reading, and it is untested by the person who wrote it.

Implications

For workflow design. Enumerate every effectful step and attempt to write its compensator. Use the three outcomes to place checkpoints. Bound the tool set per task, since an unbounded tool set invalidates the model.

For tooling. Every tool with an external effect takes an idempotency key. Every workflow writes a durable step log outside the context window. Every uncompensable action lives behind a credential the agent does not hold.

For verification. Replace self-review with an external signal wherever one exists, and where none exists, treat that absence as the reason a human checkpoint is needed rather than as a gap to be filled by a better prompt.

For further work. The missing study is empirical and specific: collect agent workflow incidents, classify each by the compensability of the step that failed, and test whether the classification predicts severity. That would move the central claim of this note from heuristic to finding, and it requires production systems the author does not operate.

Conclusion

Treating an agent workflow as a prompting problem produces checkpoint placement by intuition about trust. Treating it as a long-running distributed transaction produces checkpoint placement by a test: write the compensating action, and if you cannot, that step is where the human belongs.

The rest follows from patterns that predate the technology. Idempotency keys because delivery is at-least-once. Durable external state because a process manager needs it. Coupling reduced with staging and dry runs because tightly coupled interactive complexity produces accidents by design. And constraints enforced by controllers outside the component being constrained, because a safety property held inside a probabilistic component is not a property at all.

The uncomfortable part of the conclusion is the boundary condition. All of this holds for workflows with a bounded, pre-declared tool set. For genuinely open-ended agents, the compensators cannot be written in advance, and the honest position is that the model in this note does not cover them.

References

H. Garcia-Molina and K. Salem, "Sagas", Proceedings of the 1987 ACM SIGMOD International Conference on Management of Data, 249–259.
J. Gray, "The Transaction Concept: Virtues and Limitations", Proceedings of the 7th International Conference on Very Large Data Bases, 1981.
P. Helland, "Idempotence Is Not a Medical Condition", ACM Queue 10(4), 2012.
G. Hohpe and B. Woolf, Enterprise Integration Patterns, Addison-Wesley, 2003. Process Manager and message-routing patterns.
S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. Narasimhan and Y. Cao, "ReAct: Synergizing Reasoning and Acting in Language Models", ICLR 2023.
N. Shinn, F. Cassano, E. Berman, A. Gopinath, K. Narasimhan and S. Yao, "Reflexion: Language Agents with Verbal Reinforcement Learning", NeurIPS 2023.
J. Huang, X. Chen, S. Mishra, H. S. Zheng, A. W. Yu, X. Song and D. Zhou, "Large Language Models Cannot Self-Correct Reasoning Yet", ICLR 2024. Read alongside Reflexion rather than instead of it.
C. Perrow, Normal Accidents: Living with High-Risk Technologies, Basic Books, 1984.
N. G. Leveson, Engineering a Safer World: Systems Thinking Applied to Safety, MIT Press, 2011.
M. T. Nygard, Release It!, Pragmatic Bookshelf, second edition 2018. Timeouts, circuit breakers and bulkheads.

Agentic workflows as distributed transactions: decomposition, compensation and the human checkpoint