Agentic Design Patterns: The Patterns Behind Production AI Agents

An AI agent is a program in which a language model decides the next step, calls a tool to take it, reads the result, and repeats until the task is done. The recurring designs that make such a program reliable, safe, and affordable are called agentic design patterns. They fall into eight groups: workflows, tool use, planning, context and memory, human oversight, reliability and security, multiple agents, and evaluation and cost.

Each pattern answers one problem that appears in almost every agent once real users depend on it. The agent loses track of its goal, reports success without checking, repeats a payment after a crash, or follows an instruction hidden inside an email. A pattern names the problem, gives it a known structure, and states what that structure costs.

This article explains when an agent is the right design at all, then walks through each group of patterns, and ends with a table that maps common symptoms to the pattern that addresses them.

When do you need an agent at all?

There are four ways to put a language model into a product, and they differ in how much control the model has over the sequence of steps. A direct call sends one request and uses one answer. A workflow runs several model calls in an order that your code defines. A single agent lets the model choose its own steps in a loop. A multi-agent system splits the work across several agents that coordinate with each other.

The first design rule follows directly from this table: choose the least autonomy that solves the task. Every step to the right adds flexibility, but it also adds cost, latency, and new ways to fail. Many products that are described as agents work better as workflows, because their steps are known in advance.

Why do production agents need patterns?

Errors in an agent compound across steps, which is the main reason a demo and a production system behave so differently. If each step succeeds 95 percent of the time, a ten-step task succeeds only about 60 percent of the time, because 0.95 multiplied by itself ten times is 0.599. A demo usually runs the short path once, while production runs the long path thousands of times.

Most agentic design patterns exist to change that arithmetic. Some reduce the number of steps the model decides, some catch a failed step before the next one builds on it, and some limit the damage when a step fails anyway. The groups below follow that order.

Workflow patterns

Workflow patterns keep the sequence of steps in your code, while the model does the work inside each step. They are the first place to look, because they are the cheapest to run and the easiest to test.

• Prompt chaining splits a task into fixed steps, where each model call works on the output of the previous one. A check between steps can stop the chain early.
• Routing classifies the input first, then sends it to a specialized path. A billing question and a technical question get different instructions and tools.
• Parallelization runs model calls at the same time. Sectioning gives each call a different part of the task, and voting gives several calls the same task and compares their answers.
• Evaluator optimizer pairs a generator with a grader in a loop. The generator produces a draft, the grader scores it against stated criteria, and the loop repeats until the score passes or a limit is reached.

A related pattern, structured output as a contract, requires the model to answer in a fixed schema such as JSON. Your code can then validate each answer before the next step trusts it.

Tool use patterns

A tool is a function the model can ask your code to run, such as search_orders or issue_refund. The model never runs the tool itself; it returns a request, your code executes it, and the result goes back to the model (function calling).

Most tool failures come from tool design, not from the model. A tool needs a name and description that tell the model when to use it, parameters with clear types, and results that contain only what the next decision needs. An error message is also an instruction to the model, so "order not found; search by email instead" leads to a better next step than "error 404".

The most important tool distinction is between read tools and write tools. Reading an order is safe to repeat, while issuing a refund changes the outside world and may not be reversible. Production designs treat every write tool as a separate risk decision, with its own permissions, limits, and approval rules.

Planning and reasoning patterns

Planning patterns decide how the agent turns a goal into steps. The simplest is reasoning between actions, where the model states its reasoning before each tool call and reads the result before the next one. This interleaved loop of reasoning and acting is often called the ReAct pattern.

Plan then execute asks the model to write the whole plan first, then carries it out step by step. The plan can be reviewed before any action runs, which also makes it a useful security control, as the security section explains. Replanning watches for drift, such as a step that keeps failing or a run that stops making progress, and asks for a new plan instead of more retries.

Reflection asks the agent to critique its own output before returning it. It works best when the critique checks something concrete, such as whether the tests pass, rather than asking the model whether its answer seems correct.

Want to design agents with these patterns, step by step? Grokking Agentic Design Patterns covers every pattern in this article, with worked token counts, failure rates, and complete designs for support, coding, data analysis, browser, and incident response agents.

Context and memory patterns

The context window is the text the model can see on one call: instructions, tool definitions, conversation history, and tool results. It is a limited budget, and a long run fills it quickly. Context patterns decide what stays in that budget.

Compaction summarizes older history so the run can continue. The goal and the safety rules must live outside the summarized part, because a summary can drop them, and an agent that forgets a safety rule halfway through a run is more dangerous than one that stops. Structured note taking has the agent keep a task file or progress file outside the window, which it reads again after a reset.

Memory patterns extend the same idea across sessions. Tiered memory keeps a small set of facts always loaded and retrieves the rest only when a step needs it. Every memory design also needs a rule for forgetting, because stale memory gives the model wrong facts with high confidence.

Human oversight patterns

Human oversight patterns decide where a person approves, corrects, or takes over. The core pattern is autonomy levels per action: reading an order needs no approval, a small refund needs a policy check, and a large refund needs a person.

Approval has its own failure mode. When reviewers see too many approval requests, they start approving without reading, and the checkpoint stops protecting anything (approval fatigue). Good designs classify actions by risk, batch low-risk approvals, and measure how often reviewers actually reject a request. Escalation is the reverse direction: the agent hands the task to a person when it is uncertain, instead of guessing.

Reliability and guardrail patterns

A guardrail is a check that runs outside the model and can block an action. Guardrail layering places checks at three points: on the input, on each tool call, and on the output. A check on the tool call is the most valuable one, because it runs just before the agent changes something.

Outcome verification checks the state of the system, not the claim of the model. If the agent says the refund was issued, the harness reads the payment record to confirm it. Execution budgets cap the steps, time, tokens, and money one run can use, which stops a looping agent before it becomes an expensive one.

Durable state saves a checkpoint after each step so a crashed run can resume. Resuming creates a new risk, which is repeating a side effect such as a payment. The standard fix is an idempotency key: a unique ID sent with each write, so the receiving system ignores a second request with the same ID.

Security patterns

Prompt injection is an attack in which text that the agent reads, such as an email, web page, or tool result, contains instructions that the model then follows. No current model reliably ignores such instructions, so the defenses must be structural.

An agent becomes exploitable when it combines three properties: access to private data, exposure to untrusted content, and a way to send data out. This combination is known as the lethal trifecta. Meta's security researchers describe a related rule of two: an agent should hold at most two of the three properties in one session, unless a person approves the action.

Several patterns enforce this by design. The Dual LLM pattern gives untrusted content to a quarantined model that has no tools, while a privileged model plans and acts without ever reading that content directly. Plan then execute fixes the list of actions before the agent reads untrusted data, so injected text cannot add new actions. Least privilege gives each tool the narrowest credentials it needs, which limits what a successful attack can reach.

Multi-agent patterns

A multi-agent design is worth its cost only when the work splits into parts that can run independently, or when one context window cannot hold the whole task. Orchestrator workers has one agent divide the task and send each part to a worker agent, then combine the results. Context isolated sub-agents do a focused job in a fresh window and return only a short result, which keeps the main agent's context small.

Coordination has a real cost. Each extra agent adds model calls, and a mistake in one agent can spread to the others through shared state. Production designs define a communication contract between agents, set a budget for the whole group, and contain failures so one worker cannot stop the run. A complete walkthrough of these layers appears in Design an AI Agent: The 7-Layer Blueprint.

Evaluation and cost patterns

You cannot improve an agent you cannot measure. The first evaluation set should come from real failures, since each failed run that a user reported becomes a test case. Trajectory evaluation grades the path the agent took, not only the final answer, because a correct answer reached through an unsafe action is still a failure. Tracing records every model call and tool call in a run, so a failed run can be debugged step by step.

Cost patterns address the token bill, which grows with every step because each call resends the growing context. Prompt caching reuses the unchanged start of the context across calls, and keeping that start stable is a design decision. Model routing sends easy steps to a smaller, cheaper model and hard steps to a larger one.

How to choose the right agentic design pattern

Start from the symptom, not from the pattern. The table below maps common production problems to the pattern that addresses each one.

Most production agents use only a few patterns from each group. The skill is not knowing every pattern, but recognizing which problem a design actually has and choosing the simplest pattern that solves it.

Frequently asked questions

What are agentic design patterns? Agentic design patterns are reusable designs for the recurring problems in AI agents, such as choosing tools, planning steps, keeping context, getting human approval, resisting prompt injection, and controlling cost. Each pattern describes a structure, the problem it solves, and what it costs.

What is the difference between an AI workflow and an AI agent? In a workflow, your code decides the order of steps and the model does the work inside each step. In an agent, the model decides the next step itself, inside a loop. Workflows are cheaper and easier to test, so they are the better choice whenever the steps are known in advance.

What is the evaluator optimizer pattern? It pairs a model that generates an output with a model or check that grades it against stated criteria. The loop repeats until the output passes or a retry limit is reached. It works best when the grading criteria are concrete, such as passing tests or matching a schema.

When should you use multiple agents instead of one? Use multiple agents when the task splits into parts that can run independently, or when one context window cannot hold the whole task. Otherwise a single agent is usually cheaper and easier to debug, because every extra agent adds model calls and coordination failures.

How do you protect an AI agent from prompt injection? Use structural defenses rather than relying on the model to ignore malicious text. Avoid giving one session private data, untrusted content, and a way to send data out at the same time. Patterns such as Dual LLM, plan then execute, and least privilege enforce that separation by design.

Do agentic design patterns depend on a specific framework? No. The patterns describe structure, so they apply whether you build with a framework, a vendor SDK, or plain code. Frameworks change quickly, while the problems these patterns solve stay the same.

Related reading

• Design an AI Agent: The 7-Layer Blueprint
• Prompt Engineering vs Loop Engineering vs Graph Engineering
• System Design for RAG: Vector Databases, Chunking, and Re-ranking
• Designing LLM Inference Systems: Batching, Memory, and GPUs
• The ReAct Pattern: How an Agent Reasons and Acts in a Loop
• Single-Agent vs Multi-Agent Systems: When Splitting the Work Is Worth It
• LLM Evaluation: How to Test an LLM App Before It Ships

Ready to design agents that work reliably in production? Grokking Agentic Design Patterns teaches each pattern with worked numbers and ends with full designs you can compare against your own.