AI Agents
Custom AI Agents for Business Workflows
When a custom AI agent is justified, what controls it needs, and when a simpler automation is the better choice.
A custom AI agent is useful when a workflow cannot be handled reliably by fixed fields and simple rules alone. It may need to classify a free-text request, extract details from a document, summarise a conversation, or choose from a controlled set of tools.
It should not be given unlimited freedom. A production agent needs a narrow job, approved context, explicit permissions, and observable outputs.
Start with the business decision
Define the input, expected output, allowed actions, and escalation condition before selecting a model. For example, a lead-triage agent may read an enquiry, identify service interest, extract location and timeline, then propose a priority. The CRM update should still validate every required field.
Controls a production agent needs
- approved sources rather than unrestricted assumptions;
- schema validation for structured outputs;
- minimum-confidence and human-review rules;
- tool permissions limited to the agent's job;
- logs for prompts, tool calls, failures, and approvals;
- test cases covering missing, conflicting, and adversarial inputs;
- a safe fallback when an integration is unavailable.
For finance and healthcare workflows, avoid letting an agent make regulated or clinical decisions. It can assist with intake, document collection, scheduling, and routing while authorised people remain responsible for decisions.
When not to build an agent
If the workflow is “when a form arrives, create a CRM record and notify the owner,” ordinary automation is cheaper and more predictable. Adding a language model would create cost and uncertainty without adding value.
Begin with one measurable task. Compare completion accuracy, human correction, latency, and cost against the existing process. Expand only when the agent performs reliably under real operating conditions.
Learn about custom AI agent development or start with a business process automation assessment.
Specify the agent as a bounded worker
A useful specification names the event that starts the task, the information the agent may read, the tools it may call, the actions requiring approval, and the condition that ends the task. “Handle customer operations” is not a testable job. “Read a new enquiry, extract five fields, propose a category, and create a review task” is.
Define an allow-list for tools and parameters. An intake agent may need to create a lead but should not delete records or export the customer database. Use separate service credentials where possible, and keep secrets outside prompts and content stores. Tool responses must be treated as untrusted input and validated before another action uses them.
Memory requires the same discipline. Decide which facts belong in the system of record, which short-lived context is needed for the current task, and what should not be retained. A long conversation history is not automatically accurate or appropriate to reuse.
Evaluate behaviour, not fluent wording
Create a test set from representative, anonymised cases. Include normal requests, missing details, conflicting instructions, unsupported languages, malicious prompt content, unavailable tools, and requests outside the agent's authority. Evaluate field accuracy, tool selection, forbidden actions, escalation, recovery, latency, and cost.
Run these tests whenever the prompt, model, knowledge source, tool, or business rule changes. A model update can alter behaviour even when application code is unchanged. Version the configuration and keep a rollback path.
Operate the agent after deployment
Logs should show the task ID, model version, inputs permitted for review, structured outputs, tool calls, validation results, approval events, and final status. Protect those logs because they can contain customer or commercial information.
Set budgets and limits for repeated calls. A loop that continually retries a failed tool can create cost or duplicate actions. Use idempotency keys for writes, maximum step counts, and a dead-letter or review queue for unresolved work.
An agent is production-ready only when the business can answer three questions: what is it allowed to do, how will we know it failed, and who takes responsibility when it cannot finish safely?
Common questions
Is an AI agent better than normal automation?
Only when the workflow needs language understanding, controlled reasoning, or flexible extraction. Fixed rules are safer for predictable decisions.
Can an AI agent update business tools?
Yes, but important writes should use validated inputs, narrow permissions, logs, and approval rules.
Next step