LLM steps inside n8n: where the agent node helps and where it ruins you
An AI node in a workflow is a non-deterministic step in a deterministic pipeline. That is fine for classification and drafting, and dangerous for routing and writes. Here is where we draw the line.
n8n's AI nodes made it trivially easy to put a model inside a workflow, and the result across the accounts we have reviewed is a bimodal distribution: a handful of automations that genuinely could not exist otherwise, and a long tail of steps where a model was asked to do something a regular expression already did correctly.
The distinction is not about how smart the task is. It is about what happens when the step is wrong.
The three shapes that work
Classification with a closed list. "Is this inbound email a support request, a sales lead or a supplier invoice?" The output is one of three tokens, the downstream branches are all handled, and a wrong answer routes a message to the wrong queue where a human notices. This is the highest-value AI step in most companies, and it is cheap: a few hundred input tokens per run.
Extraction into a schema. Pulling amount, date, VAT number and supplier from an invoice into a fixed JSON shape. Use the structured-output mode so the model is constrained to the schema, and validate it anyway — a well-formed JSON with a plausible wrong number is the failure mode that hurts, and no amount of prompt engineering removes it. Validate the arithmetic, not the format.
Drafting for a human. A first-pass reply, a summary, a proposed ticket title. The agent produces, a person approves. This is where a model's failure mode — confident and wrong — is cheapest, because the approval step is doing the work that evaluation would otherwise have to.
Where it goes badly
As a router over an open set. "Decide which of these twelve systems to call and with what arguments" is the agent-node demo, and it is the one that produces incidents. Twelve tools means twelve blast radii, and the step that decides is the one you cannot unit-test. If the model must choose, constrain the choice to a list and log the choice with the reasoning.
As the thing that writes. An agent node with a tool that can update the CRM will, eventually, update the wrong record. Not often. Once per few thousand runs is enough when the workflow runs a thousand times a day. Put the write behind a deterministic step: the model proposes a patch, code validates it against rules you wrote, code applies it. That boundary is the whole design, and it is the subject of permissions for agents that act.
As a replacement for a parser. If the input format is stable, parse it. A model that reads a CSV is a hundred times more expensive and less reliable than the CSV node, and it will fail differently every time, which makes the bug report useless.
The operational parts people skip
Pin the model version. "Latest" means your workflow's behaviour changes on the vendor's schedule. Pin it, and treat a model upgrade as a change with a test run behind it.
Set a timeout and a token cap on every AI node. Without them, one pathological input becomes an expensive, slow run, and in queue mode it occupies a worker.
Store the prompt outside the node. Workflows are JSON blobs; a prompt buried at line 400 of a JSON export is a prompt nobody reviews. Keep prompts in a file or a table, reference them by key, and version them — see versioning prompts and evaluating automations.
Log inputs, outputs and cost per run. n8n will not do this for you in a form you can query. A small node that writes model, tokens, latency and the decision to a table turns "the AI step feels flaky" into a number.
What it costs
A classification step on a small model runs at a fraction of a cent per execution — for most workflows the model is not the expensive part, the API you are calling afterwards is. What blows the budget is a chat-style agent node looping over tool calls: fifteen turns at four thousand context tokens each is a different order of magnitude. If your AI node has a loop, cap the iterations.
What to do this week
Open your workflows and list every AI node. For each one, write down what happens if the output is wrong: does a human see it, or does something get written? Any node in the second group without a validation step in front of the write is the one to fix first.