The workflow engine is the agent.
A2Flow is a chat-driven workflow engine, rebuilt from the ground up around an AI agent. Not an engine with an AI step bolted into it: an engine whose runtime is an agent. It plans the work, asks the people who have to decide, and does the rest itself. The plan it makes is kept as a workflow and run again: the flexibility of a chat session, with the repeatability of a procedure.
An agent inside a workflow
The flowchart is the program, and somewhere in it sits a box labelled "AI". It fills a field, drafts a summary, classifies a ticket. Then control returns to the diagram someone drew last year, and the rest of the process runs the way it always did.
The agent is the workflow
There is no diagram to return to. The agent reads the procedure, plans the steps, binds the tools, asks for the approvals, and executes. A workflow is not something the agent takes part in. It is what the agent does.
Designed in conversation, not on a canvas
You start from an Agent Skill: a SKILL.md file in a
Git repository, versioned and reviewable like any other code. Then you talk to
the AI. It drafts the task graph, you adjust it, and the
MCP tools each step needs are bound as you go. What
you publish is the agent's own plan, kept: a workflow
nobody had to draw, and one every run follows the same way.
A run is a conversation with several people in it
Executing a workflow opens one shared chat. The applicant states the intent, the agent walks the task graph, and the approver decides right there in the same thread, with a comment. No ticket queue, no side channel, no "any update on my request?"
Every tool call carries a signed grant
An approval is not advice the agent is asked to follow. Every task that calls a tool holds a short-lived X.509 certificate over exactly the tools it held when that certificate was issued, and the MCP gateway refuses any call that does not present one, signed. Approving a task is what puts an approver's name on its certificate; a task nobody was asked to approve carries the authority of whoever started the run. A prompt injection cannot talk its way past either, and the agent cannot widen one afterwards. Every call — allowed or refused — is recorded with the certificate's serial and the exact bytes signed for it.
Plan. Approve. Execute.
The three things a workflow was ever really made of. A2Flow keeps those and hands everything in between to the agent — a standard operating procedure you carry out together with the AI.
Where to go next
- Quick start — get the backend and the frontend running on your machine.
- Terminology — workflows, design sessions, executions, and workflow sessions.
- Agent Skills — the Git-backed procedures a workflow is designed from.
- Workflows — generate a workflow from a skill, adjust it, publish it, run it.
- Approvals — how a run stops for a person, and what a certificate authorizes.
- Configuration reference — every environment variable the backend reads.