Creating an AI agent for your business: steps, options and what “free” really means

A chatbot answers; an agent acts. Anthropic, which publishes recommendations for developers, distinguishes two kinds of systems: workflows, in which the language model and tools are orchestrated through paths defined in advance in the code, and agents, in which the model directs its own process and choice of tools to accomplish the task.

The same company advises looking for the simplest possible solution and adding complexity only when it is needed, which can mean not building an agent at all: an agentic system often trades response time and cost for better performance. If all you need is to answer questions, our guide to building a chatbot is the right starting point; the detailed definition of an AI agent is covered in a separate guide.

Start with a task, not a technology: “answer incoming quote requests and offer an appointment” rather than “manage customer relations”. Describe what the agent receives, what it must produce and how you will recognise a successful task. Anthropic observes that agents add the most value on tasks that combine conversation and action, with clear success criteria, feedback loops and meaningful human oversight.

Also list what the agent must not do: out-of-scope topics, commitments it cannot make on behalf of the business, situations in which it must hand over. This list will then serve as the basis for the instructions and test scenarios.

Tools are what set an agent apart: reading a calendar, creating an appointment, sending an email, querying a database. The OWASP reference framework for language model applications describes a risk called “excessive agency”: the ability of an agent to perform damaging actions in response to unexpected, ambiguous or manipulated output from the model. It cites typical causes, such as a connector that allows documents to be modified and deleted when the agent only needs to read them, or database access with unnecessary write permissions.

The rule is therefore least privilege: every tool, every account and every permission must match a need of the mission. The ANSSI, France’s national cybersecurity agency, goes further in its security recommendations for a generative AI system published in April 2024: an AI system must be configured so that it cannot carry out critical actions automatically, for example banking transactions, producing public content or actions with a direct impact on people, and the agency strongly recommends limiting, or even prohibiting, automatic actions triggered by uncontrolled inputs, such as data from the internet or from emails.

A business agent should rely on your information rather than on the model’s general memory: offers, terms, opening hours, procedures, approved answers. How to organise this information is covered in our guide to an AI agent’s knowledge base. The instructions, for their part, describe the agent’s role, tone and scope, and what to do when information is missing.

Be careful with content the agent reads without you having chosen it: a customer message, a web page, an attached document. OWASP ranks prompt injection, direct or indirect, first among its risks: the way content can alter the model’s behaviour. It adds that it has not been established that a foolproof prevention method exists. Hence the importance of guardrails.

Guardrails combine several measures: filtering inputs and outputs, validation by a person before any sensitive action, stopping conditions (a maximum number of steps, for example) and logging what the agent does. The ANSSI recommends logging all processing, carrying out business functional tests before going into production and providing a degraded mode that allows the service to operate without the AI system.

Test first in an isolated environment: Anthropic recommends extensive testing in sandboxed environments, with guardrails, because of the cost of autonomous agents and the risk of compounding errors. Using dummy data at this stage avoids exposing real customer information. Build a set of realistic cases: simple requests, ambiguous requests, attempts at misuse, out-of-scope topics. After going live, regularly review a sample of the exchanges and correct the instructions or the data rather than widening the agent’s permissions.

There are three routes. No-code tools let you assemble an agent from blocks and connectors; specialised platforms provide an agent ready to configure for a specific use, with its channels and integrations; custom development, using the models’ application programming interfaces (APIs), offers the greatest freedom but leaves hosting, security and maintenance to you.

The word “free” covers different realities, which should be checked on each provider’s page. Two examples read on 1 October 2026: n8n’s documentation states that the self-hosted Community edition is free and can be used with no time limit, with certain features not included (projects, sharing, single sign-on, Git-based version control, for example), and hosting is then your responsibility. Microsoft Learn states that the Copilot Studio free trial can be extended by 30 days when it expires and that the agent keeps running for up to 90 days afterwards, but that the trial licence does not allow the agent to be published; a personal email address may be refused in favour of a work account. On top of this there are often quotas, consumption credits and the cost of model calls, billed on usage.

If what you need is an agent that answers on the phone and in writing, Alyas provides one ready-built: it answers from the information you give it (website, text, PDF), says when it does not know and offers to pass on the request, collects contact details, books appointments if Google Calendar or Cal.com is connected and, on the phone, transfers the call to a single number when the caller asks. For leisure venues, the voice agent can be connected to PlayPro; any other business software requires a compatibility check. The trial lasts 10 days, with no credit card required.