AI agents · Guide How to build an AI agent: tools, routes and six steps to your first agent

What an AI agent consists of

An AI agent is a program that uses a language model to decide for itself which step comes next, and uses tools to do it. What an agent is and how it differs from a chatbot and classic automation is explained in our article AI agents for business. Technically, every agent needs the same building blocks:

• Model: the language model that reads, plans and writes.
• Instructions: task, tone, rules and above all when the agent hands over to a person.
• Tools: interfaces it uses to read data or do something, such as looking up an order or creating a ticket.
• Knowledge: documents it can access, for example price lists, manuals or earlier replies.
• Limits: permissions, approvals, maximum amounts and cost limits.
• Logging and tests: every decision traceable, every change checked against real examples.

Three AI agent builder routes compared

In practice the routes are often combined: an agent in code handles the demanding check, and n8n connects it with the inbox, ERP system and CRM. Which platform fits depends less on the tool than on where your data lives, who will maintain the agent later and what data protection requires. n8n, for example, can be run on your own servers in the EU, more on this in Self-hosting n8n.

Connecting tools: what MCP is

For an agent to do something, it needs access to your systems. The Model Context Protocol (MCP) is an open standard for connecting AI applications to tools and data sources in a uniform way. Anthropic introduced it at the end of 2024, and many providers and tools now support it. For businesses this means: a connection built once, for example to the ERP system, can be used with different models and platforms. MCP is helpful, but not a requirement. Many agents manage with a few directly programmed interfaces.

Build an AI agent in six steps

1. Choose a narrow task: for example “answer questions about delivery status” rather than “take over customer service”.
2. Collect real examples: 30 to 50 typical cases with the correct answer. They are your benchmark for every change.
3. Tools with minimal permissions: the agent may read orders but not post credit notes. Write access only where it is really necessary.
4. Define instructions and handover: what the agent may do, what it may not, and when it hands over to a person, for example with complaints or uncertainty.
5. Test and measure: run the agent against the examples, sort errors by type, improve instructions and tools, test again.
6. Go live with approval: at first the agent proposes and a person approves. Only when the results have been right for weeks may it do more on its own. Cost limits and logs run from the start.

Security and law

Agents read text that comes from outside, such as emails or web pages. It may contain hidden instructions meant to lead the agent into doing something. OWASP lists this so-called prompt injection as the biggest risk of AI applications, followed among others by excessive permissions. The most important countermeasures are minimal permissions, approvals for actions with consequences and a separation between reading and writing.

Legally, most agents in a business are uncritical. If an agent talks directly with people, it must be clear that it is an AI (Art. 50 of the EU AI Act). For uses in sensitive areas such as recruitment, the obligations for high-risk AI apply from December 2027. Personal data requires a data processing agreement and, where possible, servers in the EU.

Build it yourself or have it built?

Building it yourself pays off for low-risk internal helpers if someone on the team has the interest and time to get into it. Support pays off if the agent works with customer data, connects several systems or has to run reliably over the long term. How we approach this is described on the page AI agent development. As your AI implementation partner we support you from the first prototype to operation.