Agent or Workflow? Refund Handling

A product manager wants an "autonomous support agent" that can look up an order, check the refund policy, and issue refunds without a human. You have tools: get_order(id), get_policy(topic), issue_refund(id, amount). Each LLM step is 90–95% reliable on the eval set.

1. Argue whether this should be an open-ended agent loop or a fixed workflow with LLM calls at specific points, and quantify the reliability concern.
2. Whatever you choose, list the safety controls you would put around issue_refund, including how you defend against prompt injection through order notes or customer messages.
3. What budgets, limits and observability would you add?