Plan-Then-Execute Pattern

When planning and execution are interleaved in one loop, untrusted tool outputs can influence which action is selected next. That makes the control flow itself attackable: a malicious intermediate result can redirect the agent into unsafe tools or unauthorized operations.

Split reasoning into two phases:

1. Plan phase – LLM generates a fixed sequence of tool calls before it sees any untrusted data.
2. Execution phase – Controller runs that exact sequence. Tool outputs may shape parameters, but cannot change which tools run.

This separates strategic decisions from data-dependent execution. The planner commits to a bounded action graph up front, and the executor enforces that graph deterministically, which preserves flexibility on arguments while protecting control-flow integrity.

Benefits: Fixing the action sequence up front keeps untrusted tool output out of control-flow decisions. He et al. (2025) study plan-then-execute daily-assistant agents empirically (N = 248) across tasks with different risk levels.

plan = LLM.make_plan(prompt)      # frozen list of calls
for call in plan:
    result = tools.run(call)
    stash(result)                 # outputs isolated from planner

Great for email-and-calendar bots, SQL assistants, code-review helpers—any task where the action set is known but parameters vary.

Claude Code Plan Mode

Claude Code implements this pattern through "plan mode" which shifts the agent into planning-only mode:

1. User shifts to plan mode: Explicitly request planning (e.g., shift+tab in Claude Code CLI)
2. Agent generates detailed plan: Creates step-by-step approach without executing
3. Human reviews and approves: Can modify plan before execution
4. Execution phase: Agent follows the approved plan

Effectiveness:

• Can 2-3x success rates for complex tasks by aligning on approach first
• Prevents wasted work from wrong assumptions
• Allows human expertise to guide agent execution

Dynamic boundary:

The threshold of what requires planning changes with each model generation:

"The boundary changes with every model in a surprising way. Newer models are more intelligent, so the boundary of what you need plan mode for got pushed out a little bit. Before you used to need to plan, now you don't." —Boris Cherny (Anthropic)

This means simpler tasks that once required planning can now be one-shot with more capable models (e.g., Sonnet 4.5 vs. Opus 4.1).

LangGraph Plan-and-Execute

The archived langchain.experimental.plan_and_execute package has been superseded by LangGraph, which implements this pattern with separate planner and executor nodes over a shared state graph. See the LangGraph plan-and-execute tutorial.

• Pros: Strong control-flow integrity; moderate flexibility.
• Cons: Content of outputs can still be poisoned (e.g., bad email body).

• Beurer-Kellner et al. (2025), §3.1 (2) Plan-Then-Execute.
• He et al. (2025), "Plan-Then-Execute: An Empirical Study of User Trust and Team Performance When Using LLM Agents As A Daily Assistant" – https://arxiv.org/abs/2502.01390
• LangGraph plan-and-execute tutorial: https://langchain-ai.github.io/langgraph/tutorials/plan-and-execute/plan-and-execute/
• Boris Cherny (Anthropic): "Plan mode... you kind of have to understand the limits and where you get in the loop. Plan mode can 2-3x success rates pretty easily if you align on the plan first."
• Boris Cherny: "The boundary changes with every model... newer models are more intelligent so the boundary of what you need plan mode for got pushed out."
• AI & I Podcast: How to Use Claude Code Like the People Who Built It
• Related patterns: Discrete Phase Separation splits one task into separate research, planning, and implementation conversations with fresh context; this pattern freezes a single plan before untrusted tool output arrives.