{"slug": "when-should-you-not-use-an-ai-agent-in-n8n", "title": "When Should You NOT Use an AI Agent in n8n?", "summary": "A developer who publishes n8n workflows reports that none of them use the AI Agent node, arguing that fixed workflows with a single LLM call and plain validation nodes are easier to debug and more predictable for most business automations. In testing, a lead qualifier built on Qwen 1.8B returned the same wrong score for five of six fake leads across two runs, and seven kinds of bad LLM output — including truncated JSON, refusals and a wrong invoice total — all came back as HTTP 200 with green executions in n8n. The developer's rule is that untrusted text should never reach a model with tools that act on the outside world, and outbound or irreversible actions should be drafted for human approval rather than executed by an agent.", "body_md": "The AI Agent node is the most exciting thing on the n8n canvas right now. You attach a model, give it a few tools, write a system prompt, and it decides what to do next. A lot of tutorials start there.\n\nI've gone the other way. None of the workflows I've published uses the AI Agent node. Each one is a fixed workflow with a single LLM call in the middle, and plain nodes around it that check what the model said. That's partly caution and partly what my tests kept showing me.\n\nThis is a question post more than a tutorial. Below are the situations where I'd say \"don't use an agent here.\" I'd really like to hear where you think I'm wrong, because I suspect some of these lines are drawn too tight.\n\nIf I can sketch the flow on paper as a line or a small tree, I build it on the canvas. Lead comes in, score it, alert if hot. Review comes in, classify it, draft a reply, flag it if it's angry. Invoice comes in, extract the fields, check the totals, write a row.\n\nMoving that path into a prompt doesn't make it smarter. It makes it harder to read, harder to debug, and possibly different on every run. An IF node does the same thing every time, and you can see exactly why.\n\nAn agent earns its place when the *sequence* of steps really depends on what it finds along the way, and you can't list the paths in advance. Most of the business automations I see aren't like that.\n\nThis one comes straight from a test. My lead qualifier asked a small local model (Qwen 1.8B) to score form submissions from 0 to 100. Here's what it gave five of my six fake leads, in both runs:\n\nThat was with a workflow where the model's only power was to produce a number. A plain IF node decided whether to ping Slack. The fix was cheap rules *before* the model and a guard node *after* it, and it caught three of those four. The polite agency pitch still got through.\n\nNow picture the same model as an agent with a \"send email\" or \"update CRM\" tool attached, reading that same form text. The injected instruction isn't trying to change a score any more. It's trying to change what the agent *does*. A bigger model will resist better than a 1.8B one, but \"it usually resists\" isn't the bar I want for text written by someone I've never met.\n\nMy rule: if untrusted text goes in (form fields, customer emails, reviews, scraped pages), the model gets no tools that act on the outside world.\n\nTagging a lead wrongly costs someone a minute. Replying to a public review with something you can't take back costs a lot more.\n\nFor anything outbound or irreversible (emails to customers, public replies, refunds, records other people rely on), I don't let the model act at all. It drafts, and a human or a hard rule approves. My review reply workflow returns a draft plus a `needs_owner_attention` flag. It doesn't post anything.\n\nYou can build approval steps around an agent too. But once you've put a human in front of every action that matters, it's worth asking what the agent is still deciding.\n\nI recently forced seven kinds of bad LLM output through one of my own n8n workflows: empty content, truncated JSON, a refusal, a confidently wrong invoice total, a missing required field, and so on. Every one of those seven came back as an HTTP 200 and a green execution. The only failure n8n marked red was a plain 429 rate limit on every retry, and even then the webhook caller got an empty 200 and nobody was alerted.\n\nThat was a *single* LLM call with a fixed path. The fix was one Validate node that throws on anything unusable, plus an Error Trigger workflow that posts to Slack. That's easy when there's one output to check.\n\nWith an agent, there's an output at every step: which tool it picked, the arguments, what it made of the result, and when it decided it was done. If I can't write a check for each of those, I can't say the run worked, and the green tick in the Executions list doesn't mean much.\n\nA Stripe event, a database row, a form made of dropdowns. If the data already has fields, a Switch node routes it for free, instantly, the same way every time. I've caught myself reaching for a model just to \"understand\" something that was already JSON. That's paying for tokens to make a decision less predictable.\n\nA model call costs money and time. In my lead qualifier tests, each call to the small local model took 15 to 45 seconds, while the leads my rules blocked came back in under a second. An agent multiplies that, because it can loop through several model calls per run, and the number of loops isn't fixed.\n\nFor a job that runs every few minutes with no one watching, I want a cost and a runtime I can predict. I haven't put numbers on an agent version of the same job, so take this one as a hunch rather than a measurement. But I'd want to see those numbers before I'd let it run overnight.\n\nTo be fair to agents, the shape I'd be comfortable with is:\n\n\"Look into this company and tell me what you find\" is a good agent job. \"Look into this company and email them\" isn't, at least not without an approval step in between.\n\nFor everything else, it's the same shape: trigger, a Config node, a Build Prompt node, one HTTP Request to an OpenAI-compatible `/chat/completions` endpoint in JSON mode, a Validate node that throws on bad output, then plain IF/Switch nodes that do the deciding. The model parses messy text into JSON, and the workflow decides what happens next.\n\nThe free versions of these (the lead qualifier, the review reply workflow, and the JSON guard and Slack error alert from the silent-failures tests) are on GitHub with import steps: [arkintof/n8n-ai-agent-workflows](https://github.com/arkintof/n8n-ai-agent-workflows).\n\nI'd love to hear from people who are running agents in n8n for real work:\n\nIf you think I'm being too cautious, I'd especially like to hear that, with the setup that made it work for you.\n\n*Written with AI assistance; workflow built and tested by me.*", "url": "https://wpnews.pro/news/when-should-you-not-use-an-ai-agent-in-n8n", "canonical_source": "https://dev.to/crzy_undefinedundefined/when-should-you-not-use-an-ai-agent-in-n8n-30fm", "published_at": "2026-10-23 12:09:21+00:00", "updated_at": "2026-10-23 12:12:54.487646+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "large-language-models", "ai-safety"], "entities": ["n8n", "Qwen", "Slack", "Stripe"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/when-should-you-not-use-an-ai-agent-in-n8n", "markdown": "https://wpnews.pro/news/when-should-you-not-use-an-ai-agent-in-n8n.md", "text": "https://wpnews.pro/news/when-should-you-not-use-an-ai-agent-in-n8n.txt", "jsonld": "https://wpnews.pro/news/when-should-you-not-use-an-ai-agent-in-n8n.jsonld"}}