Effective use of LLM CLIs requires careful use of plan mode—a sequence of natural-language steps to be executed by the agent. Our central observation is that such plans are programs, which we call agentic workflows. If plans are programs, then program safety techniques such as type systems, static analysis, and authorization semantics should apply directly. A deeper observation is that the LLM is not merely a producer of values, but also a generator of program structure. Tool calls can produce types that govern subsequent data, workflows that are executed as subroutines, and policies that restrict future operations. We present Pact (Programmatic Agent Control Types), a typed imperative domain-specific language in which human interaction, LLM tool invocation, and LLM reasoning are first-class typed expressions. Pact introduces a novel safety mechanism called gradual validation, together with a recovery mechanism called self-healing, under which types, workflows, and policies produced by an LLM are validated at the point of generation against the surrounding program context. As a result, we obtain a programming language for agentic workflows with valuable safety properties that are formally verified, as well as practical benefits: self-healing enables long-running tasks, reduces output token consumption by nearly threefold, and halves wall-clock time compared to assertion-based baselines.