A Workflow Agent Needs a Tape

Models solve single steps and lose the thread once the steps compose. A replayable tape buys more reliability than a better prompt. A workplace agent runs across APIs, forms, browsers, tickets, calendars, documents, and business rules. The hard part is holding state across that mess, where one wrong action corrupts the task.

Without a tape, the agent becomes a run of tool calls and confident summaries. It clicks, updates records, and moves on, and nobody can tell afterward whether it helped.

API Agents and Web Agents Fail Differently

API agents act through structured calls. The action space is named and small, and the system knows the schema.

Web agents act through pages. They handle visual layout, hidden state, DOMs that change under them, and buttons whose labels are ambiguous. People built those workflows for people, and nobody rewrote them for a model.

A rejected call reports its own error. A wrong click can leave a page that looks correct and a record that is now wrong.

Enterprises carry both. The APIs exist, and real work still leaks through browser screens. The note on software agents made the interface the part you build. Here you inherit the interface.

TapeAgents Treats the Trajectory as an Object

TapeAgents keeps the trajectory as an object. The tape records thoughts, actions, observations, and decisions in the order they happened. It also holds what the user asked for, what failed, and what is still blocked.

By replayable I mean the tape alone reconstructs the run, with the agent switched off. You debug by replaying and finding the step where it turned. You improve the agent from the same tape, because it is data about its own behavior.

A tape that records only call payloads goes blind where the web agent works. Page observations belong on it too.

The grounding note asked one question of every answer: which shelf did this come from. A workflow adds two more: what did you change, and how does a person undo it. The tape answers all three.

Models Solve Steps and Lose the Composition

WorkArena-style benchmarks measure common knowledge work. The agent must work inside enterprise software, satisfy constraints, and finish a task that takes many steps.

The benchmarks expose a common weakness. Models solve isolated steps and struggle once those steps compose. The failure sits in planning, memory, interface interpretation, and error recovery more often than in missing knowledge.

Each of those is a state problem. Planning needs the goal and the list of finished subtasks. Error recovery needs what the agent already tried and what failed. Both live outside the model.

A demo hides all of this. The person driving supplies the missing state between steps, and the overview note called that demo thinking. In production nobody holds the thread, so the agent must carry it.

State Is the Safety Feature

The system must know what it read, what it changed, and what still needs approval. It must also tell which assumptions came from the user and which came from a tool.

Drop that state and the failures are ordinary. The agent repeats steps, forgets constraints, submits half-finished forms, and treats a stale observation as current truth.

The tape is the file. The four states are its columns, written at every step and readable at any row. Remember is the loop step that fills them.

• Task state: the goal in play, and the subtasks already finished.
• World state: what the agent saw, and when that observation was valid.
• Permission state: which actions need a confirmation or a human approval.
• Evidence state: which sources justify the current answer or action.

Permission state has to sit apart from task state. An agent that infers permission from its own progress approves itself.

Write the workflow as states, transitions, roles, evidence, approvals, deadlines, and exceptions before you assign a model anything. Then give the model a job inside it: see, draft, classify, route, or act. Start with the model and you get generated messages chained through a process. That breaks at the first exception that needs a role, a deadline, or a human decision.

Ask a Human at Decision Boundaries

An agent that asks a precise question is safer than one that guesses. The design job is to make those interruptions rare, specific, and worth the user's attention.

Approval on every step is a failure with a friendly face. The user does the task twice, once by watching and once by clicking. The approvals become a reflex, and the one that mattered goes through unread.

The interrupt fires when the agent spends money, changes records, contacts people, deletes data, or acts on uncertain information. Everything else it does without asking.

That rule lives in the permission column, and the tape records who approved what. A workflow can run end to end and still need approval gates and rollback points.

The Builder Test

Replay one finished task from the tape with another person reading over your shoulder. They must see every observation, action, result, permission state, and approval without asking you a question.

Where they have to ask, the tape is thin at that step. Repair the tape there before you widen what the agent is allowed to touch.

What Carries

Judge workflow quality after the task finishes, by whether a person trusts the path. A finished task proves the agent moved. A replayable tape proves someone can follow every step, resume the task, and undo it.

A tape records what happened. Some tasks need a component that refuses to let the wrong thing happen at all.