Work in autobotAI takes one of three shapes. They share the same integrations, memory, guardrails and audit trail, so you can start with one and grow into another without rebuilding anything.
| Shape | What it is | Use it when |
|---|---|---|
| Workflow | A sequence of nodes you can read step by step. In the app, workflows are called Bots. | The steps are known and you want the same result every time, such as a weekly access review or an evidence export. |
| Agent | An AI agent with a goal, a model, tools and memory. It decides the next step from what it finds. | The path depends on the evidence, such as triaging an alert or investigating an exposed key. |
| Harness | A group of agents, triggers, memory, approval channels and a register, assembled around one outcome. | The outcome spans many runs and owners, such as keeping one application free of exploitable vulnerabilities. |
Workflows
A workflow is built from nodes on a canvas:
- Triggers start it: a schedule, an event that arrives at a listener, an API call, or a request from the service portal.
- Actions do the work: query or change a system through an integration, run Python, CLI commands, Terraform, Ansible and more. See action types.
- Logic shapes the path: conditions, loops, merges, delays and inputs.
- AI nodes add judgement where it helps: an AI evaluator classifies or scores, and an AI agent node reasons with tools inside the flow.
- People stay in the loop: an approval node pauses the run until a named approver decides, and notifications keep owners informed.
You choose the mix. Keep critical steps deterministic and let AI handle enrichment, summaries and decisions that need context. Every run is recorded in bot executions.
Not sure which shape a job needs? Choosing a workflow or a harness compares them with examples for each team.
Agents
An agent is given a goal rather than a script. It works with:
- A model you choose for the job: a fast model for classification, a reasoning model for investigation, a writing model for reports. See Deployment and models.
- Tools: the integrations, actions and workflows you allow it to use. Every workflow you build can become a tool an agent calls, so your library of workflows is also your agents' toolkit.
- Memory: memory spaces hold what agents need to recall across runs, such as prior findings, asset relationships and owner details.
- Skills: versioned, security-scanned packages of know-how your agents can load, owned and approved by your team. See Skills.
Some agents finish in seconds, like containing a reported phishing email. Deep agents plan and work for hours, like an authorized penetration test of a staging application.
Harnesses
A harness is everything one outcome needs, assembled and kept running. Optimus can build a harness from a goal you describe. A typical harness for application security looks like this:
| Part | In this example |
|---|---|
| Triggers | A nightly scan schedule, a webhook that receives findings from tools like Snyk and SonarQube, and a six-hourly sweep. |
| Agents | A scanner agent that tests the service, an intake agent that deduplicates external findings, and a resolver agent that works high-severity findings toward a fix. |
| Memory | A findings store indexed by severity, status and fingerprint, plus shared memory so agents recall earlier runs. |
| Approvals | Fixes go to the owning team in Slack or Microsoft Teams, or as a pull request, and wait for a named approver. |
| Proof | A sweeper agent re-tests closed fixes and updates the risk register, reopening anything that regressed. |
The harness's work shows up in Guardian: each finding is a task with an owner and status, and accepted risks go to the risk register with an approver and expiry.
Nine agent patterns
Security agents differ in what starts them, how long they run and how much they may change. These are the nine patterns teams build most often. All of them run on the same platform and guardrails.
| Pattern | Starts on | Runs for | Example |
|---|---|---|---|
| Deep Execution | Request | Hours | An authorized penetration test that maps findings to MITRE ATT&CK and drafts the fixes |
| Rapid Response | Event | Seconds | A reported phishing email: analyze, find every copy, quarantine, notify |
| Collaborative Coordination | Finding | Days | Chasing the owner of a public bucket until it's fixed or a time-bound exception is approved |
| Self-Service Fulfillment | Request | Time-bound | Temporary production access, scoped, monitored and revoked on schedule |
| Scheduled Governance | Schedule | Recurring | A weekly least-privilege review across cloud identities |
| Continuous Sentinel | Always on | Months | Behavioral baselines that surface slow insider or APT activity |
| Proactive Hunting and Intelligence | Threat intelligence | Minutes | Sweeping your environment for a new advisory's indicators |
| Forensics and Evidence Preservation | Confirmed incident | Minutes | Capturing evidence with write access denied by design |
| Deception and Active Defense | Attacker interaction | Persistent | Canary credentials that trigger containment when touched |
Most teams start with one high-value pattern and add others. Each new agent reuses the integrations, memory and guardrails already in place.
Next steps
- Choosing a workflow or a harness: which shape suits the job.
- Build with AI Builder and Optimus: describe the job and let AI build it.
- Build a bot node by node.
- Platform components: what to use where.
- Autonomy and approvals: decide what each agent may do on its own.