Rules Plus LLM Workflows: Make AI Digital Workers Stable Enough To Automate

A rules plus LLM workflow puts deterministic rules and model judgment inside the same execution chain. Enterprise teams often make a false choice. They either hard-code everything into a traditional process that breaks on messy documents, or they hand everything to model autonomy and then face repetitive cleanup, manual recovery, over-permission risk, and error-prone long-running work. Durable automation is usually hybrid: rules govern inputs, permissions, artifact paths, retries, and stop conditions; LLMs handle reading, synthesis, judgment, and language.

Anthropic's Building Effective Agents describes workflow patterns that combine fixed paths with model capability. The NIST AI Risk Management Framework also frames AI risk through governance, mapping, measurement, and management. Axon sits directly in this design space. System Skills and User Skills provide executable capabilities. Agents orchestrate them. Trust Mode governs risk. The workspace stores evidence and artifacts.

Stable automation does not remove humans from every decision. It automates low-risk work under rules and keeps high-risk actions inside a confirmation boundary.

Split The Workflow Into Rule Zones And Model Zones

The first design move is to stop asking the LLM to own every responsibility. A rules plus LLM workflow can be divided into four zones.

Zone	Best handled by rules	Best handled by LLMs	Axon object
Input	Required fields, file path, language, recipient format	Understanding user intent and extra notes	Source Data
Execution	Skill order, permissions, retry count	Summaries, classification, rewriting, evidence judgment	Agent steps + Skills
Artifact	File naming, directories, schema, acceptance fields	Draft writing, explanation, review summary	workspace + output schema
Risk	Sending, deleting, overwriting, external calls	Risk reason and recommended reviewer options	Trust Mode

This table is not anti-LLM. It places model intelligence where it creates value: language understanding, synthesis, uncertain judgment, and communication. Rules should cover the places where drift creates operational damage.

Rules Preserve Reuse

Rules such as "email sending requires confirmation," "PDFs land in the workspace," and "outputs must include evidence" do not weaken the model. They make the model's work usable by the next step.

LLM Judgment Does Not Replace Acceptance

The model can mark evidence as weak, but it should not accept an external deliverable on behalf of the owner. The workspace artifact acceptance contract is useful here: artifacts, evidence, and rejection reasons are the delivery loop.

Write The Hybrid Policy Down

The TOML below is not an Axon configuration format. It is a design artifact that helps teams discuss automation boundaries before implementation.

[workflow]
name = "daily-brief-to-email"
first_run = "manual"
schedule_after_verified = "workdays"

[rules.input]
required = ["topic", "source_list", "recipient", "output_language"]
reject_if_missing = true

[rules.artifact]
output_dir = "workspace/output/daily-brief/"
required_files = ["brief.md", "source-map.json"]

[llm.zone]
tasks = ["summarize_sources", "rank_findings", "draft_email_body"]
must_mark_uncertain = true

[trust_mode]
auto = ["read_sources", "write_markdown", "generate_pdf"]
confirm = ["send_email", "publish_report"]
auth = ["delete_source", "overwrite_approved_file"]

The important point is that "automatic" does not mean every action is automatic. It means the low-risk chain can run under rule protection, while high-risk actions pause in Trust Mode. If the workflow involves model selection and cost controls, read the model routing cost policy.

Diagnose Failures By Zone

A rules plus LLM workflow makes failure easier to locate. Instead of saying "the Agent is unstable," the owner can ask which zone failed.

1. Input zone failure: missing field, wrong file path, unconfigured permission.
2. Execution zone failure: missing Skill, wrong sequence, model output not matching the expected shape.
3. Artifact zone failure: no workspace file, missing schema field, weak evidence.
4. Risk zone failure: Trust Mode did not stop the right action, or the reviewer had no usable options.

This is why Trust Mode email confirmation and scheduled AI workforce governance belong together. One controls specific actions; the other controls ongoing operation.

Four Verification Questions Before Launch

Q1: Are the inputs actually stable?
Run the same task three times and confirm that Source Data fields do not need to be recovered from chat history. Missing fields should be rejected clearly.

Q2: Can the artifact be accepted on its own?
Each run should leave files, source maps, and structured output in the workspace. The owner should not need to inspect the conversation to judge the result.

Q3: Are high-risk actions stopped?
Sending, publishing, overwriting, deleting, and external calls should stop behind Trust Mode or Auth, with affected objects and risk reasons visible to the reviewer.

Q4: Can the team recover after failure?
A failed run should point to the input zone, execution zone, artifact zone, or risk zone so the team can rerun or repair the right step.

Write The Boundary First

Do not start by arguing whether rules or models are more powerful. Take one repeated task and write the input rules, artifact rules, LLM task zone, and Trust Mode boundary. Then download Axon and run a manual pilot. Read more about Trust Mode, model routing, and scheduled governance, and use a rules plus LLM workflow as the foundation for low-risk automation.