21 — AI agents
AI agents that operate tools.They do not invent sentences.
CoderConda builds AI agents: each gets tools, a task and a limit, what it may do itself, what it prepares, where a human decides. Everything else is a demo.
An example run with invented data. Real runs look the same in the log.
- May do
- read, search, draft
- May not
- send, post, credit
- 01Task understoodPlan before actionCustomer is complaining about delivery 88213. The agent says what it will do before it does it.3 s
- 02ERP readTool: ERP (read)Delivery, line items, date, history. Read only, and only its own accounts.6 s
- 03File store searchedTool: searchDelivery note and photos found by search, not by guessing the file name.8 s
- 04Contradiction noticedNo resolution without evidenceDelivery note: three boxes. Complaint: two. The agent flags it and claims nothing.5 s
- 05Draft writtenTool: mail draftA reply with the current state, the open question and a proposed date, sources underneath.14 s
- 06It stopsLimit: may not issue creditThe credit note would be the first step that moves money. It may not, so it proposes it.2 s
- 07Handover to a humanLog: 7 stepsDraft, evidence, log and proposal arrive together. Approval takes a minute.3 s
The model cost per run is capped as well.
01 — The limit
A demo gets switched off after nine days.An agent with limits does not.
A model with tools is powerful, and dangerous for the same reason, as long as nobody has written down what it may not do. What stands in the right-hand column is something the agent cannot technically trigger, even when somebody asks it nicely in a chat.
How a demo ends
- Demo
The agent solves the task in one run. Nobody asks what else it would have been allowed to do.
- Day 2
It solves a similar task a different way. That looks plausible too.
- Day 9
It sends something nobody checked. Politely worded, wrong in substance.
- After
It is switched off. Not because it was bad, but because nobody ever gave it limits.
Limits table · written in the scoping week, in the code afterwards
| Area | May do itself | Prepares | May not |
|---|---|---|---|
| ERP | Read cases, line items and dates. | A correction posting as a proposal. | Post, cancel, change prices. |
| File store | Search, open, quote. | A filing proposal with its path. | Delete, overwrite, move. |
| Read the inbox, match it to a case. | A draft in the “approval” folder. | Send. | |
| Calendar | Read free slots. | A proposal with two windows. | Book without approval. |
| Money | Recalculate and check amounts. | Calculate a credit note and justify it. | Issue credit, pay, commit. |
02 — Is it a fit?
Not every task needs an agent.For two of four I advise against it.
Four tasks, worded the way they arrive in enquiries. I say so before the quote, not after it.
YesPreparing complaintsAgent, worth it
“We get eight to twelve complaints a day. Each one needs a look at the ERP, the file store and the mail thread before anybody can answer.”
Three systems, many variants, and at the end a text a human approves. Exactly the shape where the work on permissions and limits pays for itself. The approval stays; the half hour of preparation goes.
NoInvoices into the ledger formatAutomation, not an agent
“We receive invoices as PDFs and enter them into the books. Always the same fields, always the same path.”
The path is the same every time, so nobody is needed to decide what comes next. A fixed flow with OCR and an arithmetic check is cheaper, faster and easier to audit.
To invoice processingPartlySending quotes on its ownAgent, but not through to sending
“The agent should calculate quotes and send them straight to the customer so nobody has to look at them.”
It can calculate and draft. Sending is binding, so it stays behind the approval. Delete that limit and you save a minute per quote and risk a price you have to honour.
NoQuestions about leave policyNeither, the corpus comes first
“Colleagues keep asking the same things about leave and travel expenses. An agent should take that over.”
Nothing is being done here, something is being answered. That is a knowledge base with evidence, not an agent. And while the policy sits in the intranet in three versions, no model helps.
To the knowledge base03 — The parts
Six parts get built.The model is the easy one.
- 01MCP · REST · SQL
Tools
Access to ERP, file store, calendar and tickets, each enabled separately.
- 02Its own account
Permissions
Its own account with its own permissions, not an employee’s.
- 03In code, not in the prompt
Limits
For every action it is settled: automatic, or only with approval.
- 04Audit trail
Audit trail
Every step with tool, input, result, duration and cost.
- 05Caps
Abort
Time, step and cost caps. An agent that goes in circles is stopped and says so.
- 06Measured, not believed
Review
What completes, what aborts, where humans correct most often.
04 — Who builds it
Agents are software.Not prompts.
The part you see in demos is the easy one: a model, a few tools, one impressive run. What decides operations is permissions, limits, the audit trail and cost control. I build both and run it afterwards.
- Operation
- Germany, GDPR, a data processing agreement. On request on your own infrastructure.
- Cost
- Every run has a cap on steps, time and model cost. You see what a case costs before it becomes a habit.
- Handover
- Source code, tool definitions, the limits table and credentials. Even without me, somebody else can pick it up.
Spoken in English · subtitles in English
05 — The questions
Six questionsthat come before the call.
01What is the difference between an agent and an automation?
A fixed flow knows its steps in advance. An agent decides which tool it uses next. That is strong for tasks with many variants and needlessly risky for flows that are always the same. There, classic automation is simply better and cheaper.
02How do you stop the agent doing something stupid?
On three levels. It only gets the tools its task requires. Everything binding goes through an approval. And every run has caps on steps, time and cost. On top of that there is a log in which every step can be read back. Without it I would not put an agent into operation.
03Does this need MCP?
MCP is a good way to connect tools cleanly and reusably, and I build MCP servers where they fit. It is not required: where a direct interface is simpler, I take that. The protocol is a means, not a goal.
04What does one run cost?
That depends on the model, the amount of context and the number of steps, and it is measured in the trial run rather than estimated. You get the cost per case in writing before you decide, including the point at which it pays for itself against manual handling.
05Can I start small?
That is exactly how it should go. One scope, one trial run on real data, one report. If the numbers hold, I build. If they do not, you have a defensible no instead of a pilot nobody ever ends.
06How does the agent know what is in my documents?
Through the same search a knowledge base uses: the corpus is split, tagged with permissions and made searchable. That is why this service sits next to RAG and enterprise search. An agent without a solid corpus has nothing to cite.
06 — Appointment
Which case eats your time?Talk it through with me.
Pick a time straight from the calendar and describe, in three sentences, the case that keeps eating half an hour of your time. I will tell you whether it should be an agent, an automation or nothing at all.
The calendar is hosted by cal.com.
Loading it opens a connection from your browser to cal.com (USA), which transmits your IP address; cal.com may set cookies when it loads. You can also go straight there instead.