Agentic Science Workflows
Agentic science workflows use software agents to plan, retrieve, write, reason over tools, and coordinate tasks. In life sciences, the central issue is not whether an agent sounds scientific. The issue is whether it preserves provenance and respects experimental limits. ChemCrow, Coscientist, Virtual Lab, and CellVoyager are the canonical published examples across chemistry, wet-lab biology coordination, and autonomous computational biology; ARPA-H IGoR puts agentic systems inside governed research infrastructure as a programmatic frame. The discipline is bounded tasks, source control, audit logging, separated permissions, and explicit human authorisation gates for actions involving biological materials.
Use this chapter to:
- Use tool-calling and multi-agent systems to plan, retrieve, analyze, and coordinate parts of scientific work without losing provenance or human control.
- The tool boundary matters: literature retrieval, code execution, database queries, laboratory actions, and biological design each need different gates.
Prerequisites: Self-Driving Laboratories for the hardware-coupled case; Information Hazards in Capability Research for the dual-use dimension of autonomous biological actions.
Summary: Use tool-calling and multi-agent systems to plan, retrieve, analyze, and coordinate parts of scientific work without losing provenance or human control. Agents can help with bounded research workflows, but fully reliable autonomous science remains limited by tool validation and biological evidence.
Key point: The tool boundary matters: literature retrieval, code execution, database queries, laboratory actions, and biological design each need different gates. Open question: whether agents can complete auditable workflows while preserving human authorization for consequential steps.
Bottom line: Agentic workflows connect literature, datasets, computation, lab automation, governance, information hazards, and program operations.
What is this field trying to solve? Use tool-calling and multi-agent systems to plan, retrieve, analyze, and coordinate parts of scientific work without losing provenance or human control.
What is the core idea? The tool boundary matters: literature retrieval, code execution, database queries, laboratory actions, and biological design each need different gates.
What is the current state of the field? Agents can help with bounded research workflows, but fully reliable autonomous science remains limited by tool validation and biological evidence.
What do we know, and what remains open? Known reference points include ChemCrow, Boiko Coscientist, Google Co-Scientist, FutureHouse Robin, Virtual Lab, CellVoyager, ARPA-H IGoR, tool-use benchmarks, provenance logs, and workflow orchestration systems. What remains open is whether agents can complete auditable workflows while preserving human authorization for consequential steps.
Why does this matter? Agentic workflows connect literature, datasets, computation, lab automation, governance, information hazards, and program operations.
Introduction
ARPA-H IGoR names AI/ML orchestration and agentic systems alongside laboratory automation, protocol standardisation, and distributed systems (ARPA-H IGoR, 2026). That framing puts agents inside a governed research infrastructure rather than outside it. The canonical published systems are ChemCrow (M. Bran et al., 2024), Boiko Coscientist for chemistry (Boiko et al., 2023), Virtual Lab (Swanson et al., 2025), Google Co-Scientist for biomedical hypothesis generation (Gottweis et al., 2026), FutureHouse Robin for lab-in-the-loop candidate discovery (Ghareeb et al., 2026), and CellVoyager for autonomous single-cell analysis (Alber et al., 2026).
The governance vocabulary already exists. NIST’s AI Risk Management Framework separates governance, mapping, measurement, and management of AI risk (NIST, 2023). WHO’s health AI guidance stresses human oversight, transparency, accountability, and equity for health-related AI systems (WHO, 2021). In life-sciences research, those ideas translate into scoped permissions, logged tool calls, source-linked claims, and human authorisation before any action that touches biological materials.
Agent architecture for research work
A research agent should be described by its tools, permissions, memory, retrieval corpus, execution environment, and audit record. A literature-only agent needs source retrieval, claim extraction, citation verification, and reviewer signoff. A computational-analysis agent needs sandboxed code execution, data-version control, notebook replay, and package pinning. A lab-orchestration agent needs protocol boundaries, hardware interfaces, reagent ordering limits, and human authorization gates.
The same model may sit inside each architecture, but the risk changes with the tool boundary. Read access creates source-quality risk. Code execution creates reproducibility and security risk. Procurement creates cost and safety risk. Laboratory execution creates biological and institutional risk. Evaluation should therefore be permission-specific rather than agent-generic.
Tool validation and provenance records
Agentic systems should produce a provenance record that a reviewer can replay: prompt or task, retrieved sources, tool calls, parameters, input data versions, intermediate files, generated code, execution logs, error messages, human approvals, and final outputs. A polished report without the record is weak evidence because the reasoning path cannot be checked.
Tool validation is separate from model evaluation. A PubMed tool should be checked for recall and citation alignment. A chemistry tool should be checked against known inputs and invalid outputs. A notebook tool should be checked for deterministic replay. A cloud-lab tool should be checked against protocol simulation and physical run logs. Agents are only as reliable as the least-audited tool in the chain.
Human gates for biological actions
The human gate should sit before any action that orders materials, reserves lab time, modifies a biological protocol, executes an experiment, or shares dual-use relevant details. The gate should approve a specific action, not a broad agent role. “This agent may read PubMed” and “this agent may order a construct” are different permissions and should expire separately.
What is demonstrated?
Demonstrated capability includes literature triage, code execution, protocol drafting, bounded workflow orchestration, semi-autonomous biomedical hypothesis generation, lab-in-the-loop candidate discovery, and autonomous single-cell analysis. ChemCrow, Boiko Coscientist, Virtual Lab, Google Co-Scientist, FutureHouse Robin, CellVoyager, and IGoR provide the current evidence anchors (M. Bran et al., 2024; Boiko et al., 2023; Swanson et al., 2025; Gottweis et al., 2026; Ghareeb et al., 2026; Alber et al., 2026; ARPA-H IGoR, 2026).
| Evidence Anchor | What It Supports | Practical Constraint |
|---|---|---|
| ChemCrow | LLM-tool orchestration for chemistry | Tool selection and validity bound output |
| Coscientist | LLM-planned closed-loop chemistry | Bounded chemistry domain; reproduces known chemistry |
| Virtual Lab | Multi-agent biology research with wet-lab validation | One target; generalisation is open |
| Google Co-Scientist | Biomedical hypothesis generation with in vitro validation | Hypotheses still require expert selection and experimental testing |
| FutureHouse Robin | Lab-in-the-loop candidate discovery and follow-up data analysis | Human execution, biological interpretation, and replication remain necessary |
| CellVoyager | Autonomous computational analysis of scRNA-seq datasets | Notebook analyses still require expert review and reproducibility checks |
| ARPA-H IGoR | Agentic systems inside governed infrastructure | Program ambition is not proof of deployed reliability |
| Bridge2AI | AI-ready data and workforce materials | Agents need high-quality inputs and human review |
| EMA and FDA materials | Lifecycle accountability for AI in regulated contexts | Regulatory use requires documentation |
| NIST AI RMF | Govern-map-measure-manage risk structure | General framework; must be adapted to biology |
| WHO health AI guidance | Human oversight, transparency, accountability, equity | Health framing does not replace lab-specific biosafety review |
What is theoretical?
Theoretical capability includes agents that propose experiments, call analysis tools, update models, and prepare protocol-ready plans. This is plausible for bounded settings with source control, tool permissions, and human approval. Generalisation beyond bounded settings to open-ended scientific autonomy is a research frontier rather than a deployed capability.
The operational threshold is not whether an agent can draft a protocol. It is whether the protocol, data sources, tool versions, intermediate decisions, and human approvals are recoverable after the fact. Agentic workflows that cannot produce that record are not suitable for capability claims, publication decisions, or regulated work.
What is beyond current capability?
Beyond current capabilities includes unsupervised agents conducting open-ended biological research without human governance. Biological materials, safety controls, privacy, and scientific accountability require explicit human authority. A May 2026 Nature editorial on “AI scientists” framed the boundary correctly: process and speed do not replace the human judgment that makes research worth doing and keeps it accountable (Nature, 2026). AI scientists that operate without expert review remain beyond current capabilities and outside biosafety norms.
What would make this more promising?
Agentic workflows become more promising when agents complete bounded research workflows with replayable source records, verified tool calls, and independent recovery from errors across tasks. Stronger claims need prospective evaluation showing that agent outputs change experimental decisions while preserving human authorisation for procurement and laboratory execution.
What should researchers, biotech teams, funders, and program leaders do with this?
- Require source links for literature-derived claims.
- Log tool calls, parameters, data versions, and outputs.
- Use separate permissions for reading, analysis, procurement, and laboratory execution.
- Block autonomous actions involving biological materials unless a human authorises the exact protocol.
- Cite ChemCrow, Coscientist, and Virtual Lab specifically rather than referring to “AI agents” generically.
- Treat ARPA-H IGoR as programmatic infrastructure, not as a specific deployed system.