Book a session
The Workflow Map — a Core Concept Primitive, portfolio-wide

Three Lanes. The Third One Is Why This Exists.

Most organizations' existing process maps have two lane types: human and system. The Workflow Map insists on a third from the outset — the Agent lane — because that is the entire point of an agentic engagement. A map without an Agent lane cannot produce a Governed Workflow Unit. It is grounded in BPMN 2.0 and the emerging human-agentic extension that admits agents as first-class participants, but written so an executive can read it without any BPMN training. Same rigor as the standard; zero notation to learn. It holds one agent with a human beside it, and it holds a scheduled swarm of four that nobody watches. And every box on it carries a dossier — prompt, tools, references, input, output, product, HITL and semantic graph — because a box you cannot document is a box you cannot govern.

Where it gets built AgentThrust — Phase 1, Days 1–20, live with the process owner in the room →

Manual today and Agent-owned are the same vendor-invoice workflow before and after mapping. Scheduled swarm is a different shape altogether — a clock starts it, four agents run it, and no human touches the happy path. The map has to hold that case too, or it cannot govern it.

Three-lane Workflow Map of a vendor-invoice exception queue
Human Task System Task — automated, no AI Agent Task — AI-executed Gateway · an Agentic Gateway when an agent decides Exception path Risk Tier of that step — 1 Critical, 2 Augmented, 3 Productivity
Integrations on an agent box — what it plugs into Runtime — the model the agent runs on Workspace app — mail, files, calendar System of record — ERP, TMS, queues External data feed — APIs, market data Browser / RPA — driven UI Logging & audit
The capture

The Eight Fields — How to Map a Workflow

Eight fields, in order. Fill all eight and you have a Governed Workflow Unit per step, with its permissions and escalation path already specified. Skip one and you have a diagram.

1 Trigger What starts the workflow: an inbound request, a document or email arriving, a system event — or a schedule, which may carry several fixed times (05:30 daily, plus 13:00 on month-end) or a recurring window. A scheduled workflow has no human arrival to piggyback on, so the map must also name what happens when a run does not complete.
2 Lanes (Actors) One row per actor. Three lane types only — Human, System (automated, no AI), and Agent (AI-executed) — but as many lanes as there are actors. A swarm gets its own lane, with each member a named step inside it, and an orchestrator sits in a lane of its own above it. Every step must sit in exactly one lane.
3 Steps Each step is owned by one lane and typed: Human Task, System Task, or Agent Task. Agent Tasks are further tagged Utility (a single LLM call), Document (classify / extract), Knowledge (retrieval), or Orchestrator (coordinates other agents or APIs).
4 Decision Points (Gateways) Every branch in the flow. Where an agent makes or influences the call, tag it an Agentic Gateway and record the collaboration mode: leader-driven (one agent decides) or role cooperation (agents split the work). A swarm usually runs both at once — the members cooperate, the orchestrator decides.
5 Exceptions What happens on failure, low confidence, or missing data — including a partial return, where one swarm member comes back empty and the orchestrator must decide whether the run can proceed. This is where the escalation path lives: read directly off the map, never designed separately. An unattended workflow still needs one, which is why a map with no Human lane at all is a map missing its escalation path.
6 Data Flows What data moves between lanes at each handoff, and its sensitivity classification.
7 Cycle Time & Volume Current time-to-complete and monthly volume per step — this is the KPI Contract baseline, captured here and nowhere else.
8 Systems Touched Every SaaS or licensed tool each step reads from or writes to — feeds directly into the Technology & Licensing Stack decision, which is why that decision comes after the map. On an agent box this field is drawn on the box itself, as an integration strip: the runtime the agent runs on, plus the workspace apps, systems of record and data feeds it plugs into.
In the room

How to Run the Mapping Session

Held during Phase 1, seeded by whatever surfaced in the Phase 0 Executive Lab. Four rules, and they are the difference between a Governed Workflow Unit and a wall decoration.

1Built live on a shared canvas — Miro, consistent with the Executive Labs stack — with the process owner and one technical resource in the room. Never mapped from a slide deck after the fact.
2Map the current state exactly as it runs today, including its exceptions and workarounds, before designing anything. A map that skips the messy parts produces a Governed Workflow Unit that breaks on day one.
3Every step needs a named owner before the session ends. "TBD" in a lane is a red flag, not a placeholder to fill in later.
4Every Agent Task is then classified into one of CATO's existing Risk Tiers based on what it touches — not a new scale invented for the occasion. That classification, plus the exceptions already captured, is the entire specification for the workflow's permissions and escalation path.
The harder case

Swarms, Orchestrators, and Runs Nobody Watches

A single agent with a human beside it is the easy case. The map has to hold the harder one too: several agents running in parallel, dispatched by an orchestrator, on a schedule, with nobody watching. Nothing new is invented for it — the same eight fields carry it, used a little more carefully.

↦ A swarm gets its own lane Not one "Agent" lane for everything. The orchestrator sits in its own lane and the workers share a lane beneath it, each a named step. Fan-out and fan-in then read as single gestures rather than a knot of arrows.
⇄ Both collaboration modes, recorded A swarm usually runs both at once: the members are in role cooperation — they split the work and none waits on the others — while the orchestrator is leader-driven, deciding what runs and when to stop waiting. Record which is which; they escalate differently.
⚠ The fan-in is a mapped step Three agents returning independently can disagree, and one can return nothing at all. The step that reconciles them needs an owner and an audit record like any other — and the map must say whether a partial return blocks the run or not.
⏱ A schedule needs a missed-run path An event-triggered workflow fails loudly: somebody is waiting. A scheduled one fails silently. The Trigger field therefore carries the times and the deadline — if the 05:30 run has not completed by 06:15, the map already says who hears about it.
⇧ No Human lane on the happy path is fine. No escalation path is not. An unattended workflow can and should have zero human steps when it runs clean. It still needs somewhere to go when it cannot decide — a named human, in a real lane, off the happy path.
◎ Audit must be per-agent attributable One audit line for the run is not enough once more than one agent contributed to it. Each agent's inputs, outputs, confidence, and timing are logged separately, so a wrong number traces back to the agent that produced it — and an unattended run is usually Tier 1, where that is non-negotiable.
The ninth thing

Every Box Gets a Dossier

Drawing the box is half of it. A box is not mapped until its dossier is filled in — and the dossier is the same eight headings for every box on the map, whether a person executes it, a system executes it, or an agent does:

1 Prompt The agent's working instruction, verbatim — including what it must not do. Human, System and deterministic Gateway boxes carry no prompt, and say so in one line. The absence is a finding: it is how you see at a glance which boxes an agent actually owns.
2 Tool(s) What the box runs on, at the grain of a specific system and a specific permission — not "the ERP" but "the ERP PO table, read only".
3 External references The standards, policies, contracts and client sources this box is grounded in. A box whose only reference is "how we've always done it" is a box nobody can defend to an auditor.
4 Input What arrives, and from which box. Anything arriving from outside the map is a dependency the map has not yet captured.
5 Output What leaves, including the failure shapes — ESCALATE, UNAVAILABLE, AMBIGUOUS. A box that can only succeed will eventually succeed wrongly.
6 Product — artifact or action What the box leaves behind: a document you can hold, or a change in the world. Every box produces exactly one, and naming which forces the question of whether it produces anything at all.
7 Interactions with HITL Whether a human blocks, reviews, is notified, or is absent from this box entirely — and which named human. This field is where the Risk Tier is actually decided, because the tier is a statement about human involvement.
8 Others The semantic-graph block — how this box links to AgentThrust, Chain Reactor, CATO and the rest of the Knowledge Base, plus anything true about the box that the other seven fields have no room for.

An agent box carries its integrations on its face. The chips inside it name the runtime the agent runs on — here, Claude — and the external apps and systems that box touches: a mailbox, a Drive folder, an ERP, a bank API, a treasury system. That strip is field 8 of the dossier, drawn rather than filed, so you can read straight off the map what each agent is plugged into and where the client's data crosses a boundary. A box with no chips is a box no agent executes.

Click any box on the map above and its dossier opens. All 27 are also collected in one document.

The full set Step Dossiers — every box on all three patterns, plus the methodology's own steps →
The output

From Map to Governance

Nothing about the governance layer is designed in the abstract. Permissions come from the Data Flows and Systems Touched fields. The escalation path is the Exceptions field, verbatim. The Risk Tier comes from what the Agent Task touches, using CATO's three-level scale — and a workflow with steps spanning more than one tier is governed at its highest tier. The KPI Contract baseline is the Cycle Time & Volume field. The technology stack decision waits on Systems Touched, which is why choosing an orchestration platform before the map is finished is a named anti-pattern rather than a head start.

The Workflow Map is registered as a portfolio-wide Core Concept Primitive — available to any Creativa methodology touching a process, not exclusive to AgentThrust.

Back to the methodology AgentThrust — the 90-day discipline this map feeds →