Decision Tables
Every "which one should I use" question in the book, collected as one reference.
Every table here appears in a chapter with the reasoning attached. This page is the lookup: the question, the answer, and the link to why.
Read it as a checklist when starting something, or as a differential when something is wrong.
Architecture
Should this process become an agent? Process discovery and value
| What you found | Decision |
|---|---|
| Nobody owns the outcome or can define success | Do not automate it yet. Establish ownership and a baseline first |
| The process exists mainly because two systems do not integrate | Fix the integration or process before adding a model |
| Rules cover the decision and exceptions are enumerable | Function or workflow |
| Judgment is needed, but actions can be enumerated | Model at the judgment point inside a workflow |
| The next useful action depends on evidence discovered during execution | Agent, with an authority ceiling and exit criteria |
Should this be an agent at all?
| If | Build |
|---|---|
| The steps are known in advance | A workflow. Model calls at the judgment steps only |
| The next action requires having seen what the last one returned | An agent loop. Varied content is not this test |
| You can enumerate the operations | Enumerate them. Do not add run_python |
| It is a single classification or extraction | One structured call, no loop |
What tier of architecture? Reference architecture
| Run outlives a request? | Visible side effects? | Build |
|---|---|---|
| No | No | Tier 1, web app plus a model client |
| No | Yes | Tier 2, plus a dispatcher and idempotency |
| Yes | No | Tier 2, queue plus a state table |
| Yes | Yes | Tier 3, durable execution |
One agent or several? When not to
| Reason given | Verdict |
|---|---|
| Context genuinely exceeds a window after compaction and selective retrieval | Split, isolation |
| A component must be denied tools or data another holds | Split, trust boundary |
| Two teams deploy and are paged independently | Split, ownership |
| "Specialist agents perform better" | A system prompt. Don't split |
| "It mirrors our org" | Conway's law. Don't split |
| "It parallelizes" | True only for disjoint items, that is map-reduce, not conversation |
| You cannot yet state the handoff contract and termination condition | Not yet |
Supervisor or handoff? Supervisor and handoff
| Supervisor | Handoff | |
|---|---|---|
| Use when | Work decomposes; parallel search | Ownership is genuinely separate |
| Fails by | Its context is the ceiling; the plan is fixed at maximum ignorance | Nobody owns termination; context evaporates per hop |
| Default | Yes | Only with a coordinator of last resort |
Function, MCP, A2A, or durable workflow? MCP Is Not A2A
| Boundary | Use |
|---|---|
| Same codebase and deployment | A function or typed internal API |
| A client needs to discover and invoke remote tools or read resources | MCP |
| One independently operated agent delegates a task to another and observes its lifecycle | A2A |
| Your system owns a long-lived business process that must survive failures and waits | A durable workflow, not an agent protocol |
| A remote agent needs access to a tool exposed by another service | A2A for delegation; MCP for the tool boundary. Do not collapse the identities or lifecycles |
Context and retrieval
Where does the answer live? Part IV
| The question is | Route to |
|---|---|
| "What does the policy say about X" | Semantic search over documents |
| "How much / how many / total by" | SQL. Not a vector index |
| "Why is this account at risk" | Graph traversal |
| "Where is order 4921 right now" | Live API |
| "What did the customer say last Tuesday" | The conversation store |
Which context technique? Part III
| Problem | Technique |
|---|---|
| Window fills over a long run | Compaction at a checkpoint, not edge-trimming |
| The same payload is re-sent every turn | Summarize to the fields used; pointers over payloads |
| Cache keeps missing | Stable prefix, nothing before the breakpoint moves |
| A subtask is noisy | Sub-agent isolation |
| The model reasons from its own wrong number | Typed scratchpad, only tool-returned values |
| You need it to survive compaction | The scratchpad, not the transcript |
Which retrieval refinement?
| Symptom | Fix |
|---|---|
| Right document, wrong chunk | Parent–child chunks |
| Exact IDs and codes never match | Lexical search alongside semantic |
| Top-5 is noisy but top-50 contains it | Two-stage rerank |
| Conversational phrasing retrieves poorly | Query rewriting |
| Stale answers on time-sensitive questions | Freshness routing |
| Cross-account leakage | Filtered retrieval, and prefer separate indexes |
Tools
Tool class, and what it obliges Part VIII
| Class | Example | Obligations |
|---|---|---|
| ① Pure read | get_order | None. Retry and parallelize freely |
| ② Observed read | query_warehouse | Do not repeat unboundedly: it burns quota, starts clocks |
| ③ Reversible write | escalate_to_human | You own the undo |
| ④ Irreversible write | issue_credit | Idempotency key + paired read + compensation |
| ⑤ External write | send_reply | Key checked before sending; alone in its unit of work; paired read |
Where does this value come from?
| Value | Source |
|---|---|
| Tool arguments | The model |
| Authority, identity, tenant | Your code |
| Idempotency key | Your code, never the model |
| Amount on an irreversible write | Re-derived server-side from an ID |
| Recipient of an external send | The record, not an argument |
| Taint | The fetcher, never the content |
API, browser automation, or visual computer use? Computer-Using Agents
| Available boundary | Prefer |
|---|---|
| Stable, authorized API | API tool |
| Web UI with semantic roles, labels, and a stable DOM | Browser automation with role or label locators |
| Remote desktop, canvas, legacy UI, or no programmatic surface | Visual computer use in an isolated session |
| Source repository that must be inspected and changed | Coding workspace with a pinned revision, path and command policy, external checks, and patch handoff |
| High-value irreversible action | A purpose-built API and approval gate, even if discovery happened through a UI |
| Any UI action | Assert the postcondition from authoritative state; a click is not proof of success |
Reliability
Retry this? Error taxonomy
| Failure | Retry | Where |
|---|---|---|
| Connection reset, 5xx, overloaded | Yes, backoff + full jitter | SDK only |
| 429 | Yes, obey Retry-After | SDK, with admission control behind it |
| Context length exceeded | No, deterministic | Compact and re-enter |
| Malformed tool arguments | No transport retry | Return it to the model |
| Content refusal | No | Escalate |
| Authorization denied | No | Escalate |
| Timeout on a write | No | Paired read first |
| Wrong answer | Meaningless | Evals |
Which timeout? Timeouts and retries
| Guard | Timeout |
|---|---|
| Endpoint unreachable | Connect, seconds |
| Provider accepted and stalled | Time to first token, tens of seconds |
| Stream died mid-flight | Inactivity, not total |
| The run as a whole | One deadline, set at start, propagated |
Which fallback rung? Fallbacks and breakers
| Rung | Allowed for |
|---|---|
| 1–2 Retry, alternate region | All tiers, automatically |
| 3 Reduce scope | All tiers, prefer this to swapping models |
| 4–5 Smaller model, other provider | Tier 0 only, and only if eval'd as its own variant |
| 6 Human | Any tier, and the first choice above tier 0 |
Durability
Workflow or activity? Part XI
| The code | Goes in |
|---|---|
| Decides, branches, orchestrates | Workflow |
| Finds something out | Activity |
| Calls the model | Always an activity |
| Calls a tool | Always an activity |
| Reads the clock, generates an ID | The SDK's replay-safe version |
| Waits days for a human | Workflow timer + signal |
Which durable runtime? Two Durable Runtimes
| If | Choose |
|---|---|
| You deploy on Vercel, the agent is the product, TypeScript end to end | Vercel Workflow / WorkflowAgent |
| Waits run to weeks, retry behaviour is complex, the stack is polyglot | Temporal |
| The agent is one process among many, and you need the history as an audit artifact | Temporal |
| Your company already runs one of them | That one. It is not a per-project decision |
| Both are already in the building | One owns durability; the other is a library. Do not use WorkflowAgent |
In-flight runs during a change Rollout
| The change is | Running executions |
|---|---|
| A quality improvement | Finish on the old bundle |
| A bug fix | Migrate |
| A policy or authorization change | Always re-evaluated at the moment of action |
Human in the loop
What tier is this call? Risk tiers
| Reversibility ↓ / Blast radius → | One entity, small | Many, moderate | Wide, large |
|---|---|---|---|
| Reversible | Tier 0, autonomous | Tier 1, notify | Tier 2, inline approval |
| Costly to reverse | Tier 1 | Tier 2 | Tier 3, two people |
| Irreversible | Tier 2 | Tier 3 | Tier 3 |
Blast radius is computed from the arguments, at call time, not from the tool.
Security
Which control for which threat? Part XVII
| Threat | Control | Not a control |
|---|---|---|
| Indirect prompt injection | Capability ceiling on tainted runs | Input classifiers, delimiters |
| Corpus poisoning | Provenance column + trust-split indexes | Outlier detection |
| Over-scoped tools | Argument scoping; remove the parameter | Tool-level allowlists alone |
| Agent as superuser | Delegation: sub = user, act = agent | Filtering results after a privileged read |
| Cross-tenant leakage | Row-level security; separate indexes | WHERE in the query builder |
| Code execution | MicroVM + broker + egress deny | A container |
| Data exfiltration | Remove the egress vector | Monitoring for it |
| Erasure requests | A deletion registry + subject IDs on derived data | A DELETE on the main table |
Is this a defense? One test: would it still hold against an adversary who gets unlimited attempts and knows it is there? If not, it is mitigation. Deploy it; do not grant capability because of it.
Governance
What evidence must exist at each lifecycle stage? AI Governance
| Stage | Minimum evidence |
|---|---|
| Proposal | Intended purpose, affected people, owner, baseline, expected value, prohibited uses |
| Design | Data flow, authority contract, risk classification, human-oversight plan, supplier inventory |
| Release | Eval results, security tests, approval, rollback plan, operator runbook |
| Operation | Versioned traces, incidents, overrides, drift, cost, affected-user feedback |
| Material change | New impact and risk review; do not inherit approval from the previous bundle |
| Retirement | Revoked credentials, stopped workflows, deleted or retained data by policy, archived evidence, user migration |
Use the NIST AI RMF Core and Playbook as primary references for the lifecycle controls. For legal dates and scope, consult the maintained European Commission AI Act implementation FAQ and qualified counsel.
Evals and operations
Which eval, for which question? Part XIV
| Question | Instrument |
|---|---|
| Did my change break something? | CI suite on fixtures |
| Did my code change break something? | Replay, deterministic |
| Did the model change under me? | Frozen canary, on a schedule |
| Is it good on real traffic? | Online scoring on a sample |
| Would this new policy fire wrongly? | Shadow replay against recorded runs |
| Is a candidate prompt better? | Shadow execution, then canary |
Diagnosing a quality drop Drift
| Canary | Inputs | Diagnosis |
|---|---|---|
| Stable | Stable | Check the deploy timeline first, it is usually you |
| Dropped | Stable | The provider changed |
| Stable | Moved | Your users changed: a new segment, phrasing, or season |
| Stable | Stable, retrieval hit rate down | The corpus moved without touching the inputs. Check the last ingestion diff |
| Stable | Stable, and still down | Audit the memory store and the tool contracts |
Which cost lever? Cost engineering
| Lever | Leverage | Quality risk |
|---|---|---|
| Cut turns | Superlinear | None |
| Shrink what's re-sent per turn | Large | None |
| Prompt caching | Large on repeated prefix | None |
| Batch endpoints | ~half, latency-tolerant work | None |
| Model routing / cascade | Large | Real, the gate can be wrong |
| Cheaper model everywhere | Proportional | Degrades everything at once |
The meta-table
Four questions recur across every table above, and if you only remember four things, remember these.
Who owns this state? Model, graph, workflow, or database. Most architectural mistakes are state at the wrong altitude.
Where does this value come from? If it grants authority, it comes from your code.
Would it hold against an adversary with unlimited attempts? If not, it is mitigation, not control.
What is the worst well-formed call on this path? That number is your blast radius, and it is the one you can change.
Next: Glossary, terms this field uses inconsistently, defined once.