Reimagining Workflows in the Agentic Age

Workflows have taken several quantum leaps on a journey that began with rule-based routing of documents, evolved into business process management (BPM), and then added intelligent BPM systems capable of handling complex processes and orchestrating across multiple applications. But the most significant leap is certainly the one in progress right now—agentic workflows that can operate autonomously.

Automated workflows are pervasive, and have been for years. They are found not only in purpose-built workflow solutions, but also are embedded in a wide variety of other KM products, including business intelligence (BI) and customer relationship solutions. BI systems, for example, incorporate automated data collection and analysis, as well as the preparation and distribution of the resulting reports, in their workflows.

Agentic workflows can extract the critical information trapped inside documents so they can be used as part of larger processes. For example, in content management systems, they can autonomously create documents, then route them intelligently through review and publication. Agentic workflows can also analyze documents and, based on their contents, route them through approval processes related to governance. 

Governance via Workflow

Samsung is a global supplier of semiconductors, consumer electronics and appliances, and heavy equipment such as ships and offshore drilling apparatus. In order to establish a working relationship with a vendor, the governance, risk, and compliance (GRC) department at Samsung Semiconductors needs to carry out a risk assessment. The organization had been using an emailbased workflow that was time-consuming and required collecting documentation from numerous sources. Each piece of documentation had to be inspected by a worker, and the process took anywhere from 3 to 5 days to complete.

In order to improve efficiency and reduce the time required for risk assessment, the GRC team began using Box AI to automate the GRC workflow and analyze vendor information. The application extracts relevant metadata and seeks out the information needed to assess risk. A Box Agent then calculates a risk score based on criteria established by the GRC department. Subsequently, a second agent identifies security issues that should be addressed. Each vendor can now be assessed in approximately 4 hours rather than several days.

Initially established in 2005 as a means for centralized storage and collaboration, Box systematically added features such as e-signatures, compliance, and integrations with 1,500 applications. “Over the past 3 years, we have shifted our approach to activate the content in multiple ways with AI, but with a lot of security and governance wrapped around it,” said Kelash Kumar, VP of product management, agentic AI workflows, at Box. “Most content these days is unstructured, and AI can extract more value from it.” Box does not charge for storage in its business-level offering; the pricing model has different levels based on file size uploads and number of API calls.

Box can carry out classification, extraction, and then bring together content and processes. “If you have well-organized, accurate content, then AI can be effective,” noted Kumar. “But there needs to be a human in the loop to ensure a high level of confidence.” In a survey Box conducted on the state of AI, 90% of customers said that concerns about security and governance of AI is their number-one barrier to using it. Having a human in the loop provides that assurance.