How to build AI agents.

Most so-called AI experts build only one and two.

The loop.

A goal comes in. The model decides what to do. It uses a tool. It reads what came back. Then it goes round again, knowing more, until it decides it is done.

If you can draw the flowchart, write the flowchart.

It is cheaper, faster, and you can test it. Reach for an agent only when the steps genuinely cannot be known ahead of time.

Most business processes are flowcharts nobody has written down. Writing them down is usually the useful project, not buying an agent to guess them.

Two words worth knowing: tools and skills.

The same job, both halves: answering a customer support enquiry. The skill is a set of previous support conversations that went well, and how you talk to customers. The tool is permission to change that customer's address in the database.

Skills are where quality comes from. Tools are where the risk lives.

Tune skills freely; hand out tools one at a time. Remember that sentence. It is the reason the security part exists.

1. Write your process down. You cannot automate what you have not defined. Write out the steps a person takes today, in order, in plain sentences, including the decisions they make and what they need in front of them to make each one. This is the work. Everything after it is assembly.
2. Choose the right level for it. Match the process to one of the first three tiers above. Most processes belong lower than people assume.

The file that tells the agent how you work.

An AGENTS.md file is a plain text file that sits in the folder the agent works in. No code. Written sentences. The agent reads it before it starts, every time, so you stop re-explaining your context in every conversation.

Four things belong in it: what this is, always, never, and ask me first. Keep it short. A long one makes the agent worse, not better.

# Vogel Garten & Landschaft
Thirty people, Graz. Private gardens and small
commercial grounds.

## Always
Write to customers in German, informal "du".
Quote prices including VAT.
Put the site address in every job reference.

## Never
Send anything to a customer before I have seen it.
Touch the payroll folder.

## Ask me first
Any refund, or a discount above 10%.
Anything for a customer we have not worked with.

CLAUDE.md is Claude's own name for the same file. Claude reads CLAUDE.md when it finds one and falls back to AGENTS.md when it doesn't; the other tools read AGENTS.md directly. One file is enough, and AGENTS.md is the safer name, because it is the one everybody agreed on.

Which one fits you.

What breaks first, in order.

1. The price. Per-seat and per-credit pricing outruns what you'd pay to run the same thing yourself, usually somewhere around ten users.
2. Everyone has their own agent. Each person configures their own. You end up with twenty private assistants instead of one company asset, and nobody can improve it for everyone at once.
3. No audit trail. The first time someone asks "what did it look at, and on whose behalf?", most of these products have no answer.
4. It can't reach your actual systems. The CRM and the accounting connectors are gated to the most expensive tier, or simply don't exist.
5. You can't set the rules. What the agent may and may not do is decided by the vendor's judgement, not by a policy you wrote and can check.

Four parts. You are assembling them, not writing them.

Every part of this can be bought or downloaded. None of it needs to be written from scratch. What it needs is someone to decide what goes in each box, and that person does not have to be technical.

Building your own, in a nutshell.

If you want to try this yourself this week, this is the whole procedure.

1. Install the desktop app. Claude or ChatGPT. Either one works; pick the one you already use.
2. Switch to the agent mode. Claude Code in the Claude app, Codex in the ChatGPT app. That is the mode where it can read your files and do work, rather than only talk about it.
3. Check that you are on a paid plan. The free tiers will not carry a build like this.
4. Start a new project and describe your business in detail. Your processes, step by step. Photograph your handwritten notes and show it the photos. Add the PDFs, the documents, the spreadsheets. List every piece of software and every tool the business runs on. Give it everything you have. This is the step that decides how good the result will be, and it is the one people rush.
5. Ask it for a plan. "From everything I have given you, write me a plan to automate as much of this as possible." Then read the plan properly and argue with it before you accept it.
6. Follow the plan.

Roadblocks are normal, and they nearly always arrive at step four or five: either the process was never written down clearly enough, or the plan is larger than the time you have. If that is where you end up, that is exactly the part I do for companies: book a consultation call.

The smallest thing that works.

For a company of roughly 20–80 people with nobody in IT. Four steps, in this order.

1. Turn on the knowledge feature you already pay for. ChatGPT Business or Claude Team, pointed at your Drive and your chat. Zero build. Do this first and live with it for a month. It tells you what people actually ask.
2. Add three or four automations, from templates. Zapier or Make. Lead intake, ticket routing, meeting notes into Slack. Use the templates; don't hand-build branching logic.
3. Give two or three people one real agent. Lindy is the most genuinely no-code of the builders. Pick the single highest-value repeating task (inbox triage, drafting replies) and only that one.
4. Name an owner. One person, even at a fifth of their week, accountable for the documents, the connectors and the bill. This is the step everybody skips and the reason most of these quietly die.

Roughly $500–600 a month for a 40-person company with ~15 active users. One to two weeks to stand up, and most of that is getting people to change how they work, not setup.

Where the line is.

No-code holds right up until the agent has to respect who-may-see-what, chain more than two or three tools with real branching, or run reliably enough that nobody has to check it.

What will break, in the order it breaks.

1. Day one: your documents. Two versions of the same policy, a scanned PDF nobody can read, a spreadsheet where the answer is a formula. The agent answers confidently from the wrong one and nobody notices for a week.
2. First month: who can see what. Someone outside HR asks a broad question and the agent helpfully surfaces a salary band, because the search doesn't know about the folder permissions.
3. Months one to three: nobody owns it. No one adds documents, prunes the old ones, or checks it still works. People stop trusting it, then stop using it. This is the most common death.
4. Month two or three: the bill. The $500 a month becomes $1,800, because automations ran more often than expected and credit pricing multiplies quietly.
5. Slowest and worst: quality drifts. A model update, a stale document or a broken connector degrades answers with nothing to catch it, until a customer finds the bad answer before you do.

Three ingredients. Any two are fine. All three in one agent, and you are one email away from working for someone else.

No prompt fixes this.

The model reads one stream of text. Your instructions and a stranger's arrive in the same channel, as words, and there is no line between them.

Ask yourself one question about anything you switch on: can it read something sensitive, can an outsider get text in front of it, and can it send something out? If all three are yes, that is the incident waiting to happen.

Five rules that make it survivable.

1. Read-only first, automation after. Version one answers questions. It cannot send, edit or pay. Add each ability separately, once you trust the last one.
2. Separate reading the outside world from touching your data. Whatever reads incoming mail and web pages should not be the same thing that holds your files.
3. Every question runs as the person asking it. Never one shared login that sees everything. That is how a query from the newest hire reaches the founder's folder.
4. Keep a log. Every question, every document it opened, every action. You will want it exactly once, and on that day you will want it badly.
5. Move your email codes to an authenticator app. Nothing to do with your agent, twenty minutes, and it closes the most common version of this attack outright.