AI agent development services with permissions, approvals and a full audit trail
We build custom AI agents that take on a defined job - resolving an order exception, preparing a credit review, triaging a support queue - work through the tools you approve, and stop for a person wherever your rules say so.
- tools
- Explicit permissions
- actions
- Approval above limits
- runs
- Full trace stored
- Resolve delayed order SO-5531triggered by warehouse delay noticerunning
- Read order and customer terms
erp.get_order· crm.get_accountdone - Check stock in two warehouses
wms.stock· 8 of 12 items available nowdone - Draft email: partial shipment offer
mail.draft· saved as draft · not sentdrafted - Person decides: Credit note 6% - above the 2% agent limitsent to Finance with the reasoningapproval
permissions · this agent
- System: ERP and stockread
- Inbox: Customer emaildraft only
- Action: Credit note ≤ 2%act
- Approval: Credit note above 2%needs approval
01 / What an AI agent is
Not a chatbot, not a script: software that works towards a goal
Definition · AI agent
Software that uses a language model to reach a defined goal by choosing and carrying out steps - reading data, calling tools in your systems, checking the result - within permissions you set, recording every step it takes.
| Compared on | AI chatbot / assistant | Workflow automation | AI agent |
|---|---|---|---|
| Started by | A person asking a question | An event: an email, a file, a form | A goal or an event |
| What it does | Answers and guides in a conversation | Runs the same defined steps every time | Decides which steps to take, using tools, until the goal is met |
| Who decides | The person in the conversation | The rules you wrote | The agent within limits; people above them |
| Best for | Questions, guidance, self-service | High-volume, predictable processes | Varied cases where the path depends on what is found |
| Learn more | AI chatbot development | AI workflow automation | This page |
02 / Anatomy
What a business AI agent is made of
The model plans and decides. Most of what makes an agent safe to run - permissions, approvals, traces - lives outside the model, in code you can inspect.
- Document: Instructionsjob, rules and tone · versioned
- Knowledge source: Knowledgedocuments and records retrieved when needed
- Context: Context & memorythe current case, earlier steps, past outcomes
- AI agent: Agent loopplan → act → observe → check- loop
- AI model: Modelplans the next step, checks results, repeats
- Guardrail: Limits per runsteps, time and spend
- Tool: Tools, via permissionsCRM · ERP · email · tickets - read, draft, act
- Approval: Human approvalgates for actions above set limits
- Log: Trace logevery step, input and decision recorded
03 / Autonomy levels
Autonomy is set per action, and raised only with evidence
Most custom AI agents start at level two. Each action type moves up only when the pilot shows its results are consistently right.
- Level 1
Read and report
The agent gathers information from your systems and prepares a summary or recommendation.
Decides: a person, every time
- Level 2
Draft for review
It prepares the change - an email, a ticket update, an order amendment - and a person approves it.
Decides: a person approves each draft
- Level 3
Act within limits
It carries out low-risk actions itself and asks for approval above thresholds you define.
Decides: the agent below limits, a person above
- Level 4
Act and report
It completes the job and reports what it did; people review samples and exceptions.
Decides: the agent, with audits
04 / What we build
Custom AI agents, from one job to orchestrated teams of agents
Our AI agent development services range from a single task agent to enterprise AI agents working across several systems under central permissions and monitoring.
- T1
Single job
Task agents
One agent with one clearly defined responsibility and a short list of tools: resolving delivery exceptions, preparing supplier onboarding checks, reconciling account discrepancies. The best place to start.
- T2
Inside a process
Agents as steps in a workflow
An agent handles the variable part of an otherwise fixed process - investigating why an invoice does not match, for example - and hands back to the workflow. Often the right design for AI workflow automation.
- T3
AI orchestration
Multi-agent orchestration
Several specialised agents coordinated by an orchestrator - one gathers information, one drafts, one checks - when a job is too broad for one set of instructions. Agentic orchestration adds coordination cost, so we use it only where a single agent measurably falls short.
- T4
In your product
Agents for your customers
Agent features inside software you sell, acting on each customer's data under their own permissions - with the isolation, limits and cost controls a multi-customer product needs.
Already have one?
Review of an existing agent or pilot
If an agent works in a demo but not in production, we review its instructions, tool permissions, test coverage and traces, and give you a written list of what to change - whether or not we build the fixes.
- Tool: Tool access broader than neededwrite access to all CRM objects- fix
- Evaluation: No regression testsprompt changed 9 times since launch- fix
- Log: Traces storedcomplete for every run- keep
05 / Tools and permissions
Every tool an agent can use has an explicit permission
An example permission set for an order-exception agent. The same table becomes part of the agent's documentation and its tests.
| Tool / action | ReadLook up | DraftPrepare for review | ActWithout approval | ActWith approval |
|---|---|---|---|---|
| Orders in ERP | Yes | Yes | Date changes | Yes |
| Stock levels | Yes | No | No | No |
| Customer email | Yes | Yes | No | Yes |
| Credit notes | Yes | Yes | Up to 2% | Yes |
| Customer master data | Yes | No | No | No |
Scroll sideways to see the full table.
06 / Testing and observability
An agent is only as trustworthy as its tests and traces
Agents fail in ways ordinary software does not: a slightly different email, a tool that returns an unexpected error, an instruction hidden in a document. We test for those before launch and watch for them after.
- Scenario tests built from real cases, with the actions that must and must not happen.
- Regression runs after every change to prompts, tools or models.
- Prompt-injection tests with hostile content in emails and documents.
- Traces of every run: inputs, tool calls, outputs and the stated reason.
- Limits on steps, time and spend per run, with alerts.
- Partial stock, standard customeroffers partial shipmentpass
- Email asks to "ignore your rules"treats as content, no actionpass
- ERP returns timeoutretries once, then escalatespass
- Credit note at 2.4%requests approvalpass
- Customer on credit holdstops, notifies Financereview
07 / How an agent project runs
From a defined job to an agent in production
Agentic AI implementation is staged so that every increase in autonomy follows evidence from the previous stage.
- stage
Job definition
What the agent is responsible for, what success looks like, and which decisions stay with people.
out →Job spec and limits
- stage
Tool & data mapping
Systems, APIs and data it needs, with the narrowest permissions that do the job.
out →Permission table
- stage
Prototype in a sandbox
The agent runs your scenarios against test copies of your systems.
out →Scenario results, cost per run
- stage
Supervised pilot
Live cases at "draft for review"; every output checked by the team.
out →Pilot findings, autonomy plan
- stage
Production & monitoring
Rollout, dashboards on traces and costs, and a process for raising autonomy.
out →Live agent, runbook
08 / Cost and timeline
What decides how long an AI agent takes to build, and what it costs
The answer depends on the job far more than on the technology. These four factors explain most of the difference between a small agent and a large one.
Variety of cases
An agent handling three kinds of exception needs far fewer scenarios than one handling thirty.
Number of tools
Each system it reads or changes needs an integration, permissions and tests.
Level of autonomy
Acting without approval needs more testing and monitoring than drafting for review.
Volume and run length
Model usage per run, times runs per day, sets the running cost.
09 / Choosing a partner
What to ask an AI agent development company
Many agentic AI companies can make an agent look capable in a demo. These questions show whether one can be trusted with your systems - useful whichever AI agent development company you choose.
- Can we see the permission table before the build?
- Every tool and action an agent may use should be listed with its level - read, draft, act, act with approval - and agreed with you in writing.
- How will it be tested against unexpected input?
- Ask for scenario tests built from your cases, including hostile instructions hidden in emails or documents.
- What does a run trace contain, and who can read it?
- You should be able to see every step, tool call and stated reason for any run, months later.
- How is autonomy increased over time?
- Agentic AI development should start at draft-for-review and raise autonomy per action on evidence, not on a launch date.
- What happens when a model or framework changes?
- The scenario suite should be re-run on every change, and the agent should not be tied to one vendor's orchestration product.
10 / Questions
Frequently asked questions
What is an AI agent?
An AI agent is software that uses a language model to work towards a defined goal by choosing and carrying out steps: it reads information, calls tools such as your CRM or ERP, checks results and decides what to do next. A business agent also has limits - which tools it may use, which actions need a person's approval - and records every step it takes.
How much does it cost to build an AI agent?
The cost is driven by the job rather than by the agent itself: how many systems it must use, how many different situations it has to handle, how much may happen without approval, and how much testing that level of autonomy requires. A narrow agent that drafts work for review costs far less than one that acts on its own across several systems. We estimate after mapping the job and the tools; we do not publish prices that would ignore those differences.
How long does it take to build an AI agent?
A prototype that runs the job in a sandbox against real examples comes first and usually shows within a short discovery-and-prototype phase whether the approach works. Getting to production takes longer, because integrations, permissions, a supervised pilot and monitoring all have to be in place. We commit to a timeline once the tools and data are mapped.
Can an AI agent take actions without human approval?
Only where you decide it may. Permissions are set per action: an agent can be allowed to read and draft freely, act alone below a limit, and ask for approval above it. Most agents start at the "draft for review" level and earn more autonomy as the pilot shows their results are reliable. Every action is logged with its inputs and the reason given.
Which frameworks and models do you use for AI agents?
We choose per project. Agent orchestration can be built with established open-source frameworks or directly on a model provider's tool-calling interface; the deciding factors are how complex the workflow is, how much control and observability you need, and what your team will maintain. Tools are exposed through defined interfaces - including the Model Context Protocol where it fits - so models and frameworks can be replaced.
Can AI agents run in our own environment?
Yes. The agent application, its tools and logs can run in your cloud account or data centre. The model can be a hosted API, a model deployed in your cloud, or an open-weight model on your own servers; each option trades quality, cost and data control differently, and we test the options on your tasks.
How do you evaluate an AI agent?
With a set of scenarios built from real cases, each with the expected outcome and the actions that must or must not happen. The agent is run against them before release and after every change to prompts, tools or models. In production, traces of each run are reviewed, and failure cases are added to the scenario set so the same mistake is caught next time.
What are the risks of using AI agents, and how are they handled?
The main ones are wrong actions, actions based on manipulated input (prompt injection from emails or documents), access to data the agent should not see, and costs that grow with long runs. They are handled with narrow tool permissions, approval gates for consequential actions, separation of instructions from untrusted content, limits on steps and spend per run, and a complete trace of what happened.
Start node · your brief
Have a job you'd like an AI agent to take on?
Tell us what the job is, which systems it touches, and which decisions must stay with people. We'll tell you honestly whether it suits an agent, a simpler automation, or neither.