Autonomous agent development, for work that crosses your systems.

Most jobs sold as agents are workflows.

Anthropic, which builds the Claude models, draws the line cleanly. In a workflow, models and tools follow code paths written in advance. An agent directs its own process and picks its own tools. Anthropic's advice is to find the simplest solution that works and add complexity only when it demonstrably improves the outcome.

We take that advice literally. A job that runs the same five steps in the same order every time is cheaper to run as a workflow, easier to test, and it fails in ways you can predict. We build it as workflow automation and make that clear before we quote.

An agent pays off where the path depends on the input: an email that could be a new order, a complaint or a moved delivery date, or a supplier document that has to be matched against three systems before anyone knows what it is.

Irreversible actions always wait for a person.

Spending money, deleting a record and contacting a customer for the first time are held for approval. The rule lives in the tools, outside the model.

A prompt is text, and text can be argued with. An email the agent reads can carry instructions of its own, which is why prompt injection heads the OWASP Top 10 for LLM Applications. So the gate sits in the tools and in the systems they call. For a first message to a customer, the agent gets a tool that drafts and queues. It never gets one that sends.

OWASP names the failure excessive agency and traces the damage to tools with more functions than the job needs, permissions wider than the job needs, and high-impact actions that run with nobody approving them. Its remedies are the ones we build: fewer and narrower tools, with authorisation checked by the downstream system itself. Anything high-impact also needs a person's approval.

In every agent we build, these wait for a person:

• A first message to any customer
• Payments, refunds and anything else that commits money
• Voiding, cancelling or deleting a record
• Anything above a threshold you set, such as a discount, a quantity or a credit limit

We run our own company the same way. Money and state move through deterministic code, and no model sits in that path.

Six controls ship with every agent.

Each one is tested before launch.

• Narrow tools. Each is a typed function against one system: create a draft, read a record, hold a slot. None is a raw database connection, and each is tested on its own before a model is pointed at it.
• A hard gate. Spending, deleting, sending to a customer and anything over your thresholds are blocked in code. A held action lands in an approval queue with the context a person needs to release it in one decision.
• An audit trail. A full record of each run, from the input and the plan to every call the agent made and the state it left. When an action is wrong, the trail shows why and the action is reversed.
• An undo for every action. Each undo is tested before the agent goes live.
• Budgets. Token and call limits per run, with an alert. Unbounded consumption is on the OWASP list because an agent caught in a loop keeps spending until something stops it.
• An evaluation set. Scenarios drawn from your own records, including those where the right answer is to refuse. It runs on every change, and a model upgrade has to pass it before it reaches you.

One clean run proves little.

τ-bench, published in June 2024 by Yao and colleagues, put agents with real tools and written policies in front of simulated customers. The best function-calling agents of the time, GPT-4o among them, completed fewer than half the tasks. Given the same retail task eight times, they got all eight right on fewer than a quarter of tasks.

Models have improved since. We still judge an agent on repeated runs of scenarios taken from your own records, and you get its pass rate as a number before anyone depends on it.

In June 2025 Gartner predicted that over 40% of agentic AI projects will be cancelled by the end of 2027, because of escalating costs, unclear business value or inadequate risk controls. Our contract answers each cause with one job that has a measurable before, a running cost estimated from your real volumes, and the gate described above.

Good agent work has a clear end and a cheap check.

The input can vary from case to case. The result has to be easy to verify. Typical candidates:

• Chasing a missing document until it arrives, then filing it
• Turning an email enquiry into a draft quote in the ERP
• Reconciling a delivery note against its purchase order and flagging the difference
• Preparing the weekly report and saying what changed since last week
• Triaging support requests and answering the repeat questions from your own documents

Two kinds of job suit an agent badly. One is work where a single mistake a month is unacceptable and the result cannot be checked cheaply. The other is any decision a regulation reserves for a person. There, the agent prepares the file and a person decides.

Six steps from one job to a live agent.

Every first agent follows the same path against a real system, and the signed proposal dates each step.

• Pick one job. Narrow and repetitive, with a measurable before. An agent that helps in general cannot be judged, and rarely survives its first bad week.
• Map the systems. The records it reads, the ones it may write and the ones it must never touch. Most of the engineering happens here.
• Build the tools. Typed, permissioned and tested one by one.
• Wire the gate. Thresholds, the approval queue, and the screen a person sees when a held action needs releasing.
• Shadow run. For a fortnight it proposes and a person approves everything. Every disagreement becomes a test case.
• Release on tight limits. They widen only as the evaluation set shows the agent can cope, and the release stays reversible at every point.

The model is chosen for the job, and named.

Your proposal names the model picked for the job, and it changes if you ask. We have no partner or reseller deal with any model provider.

Agents reach your systems through their APIs. ERPNext, which runs our own books, exposes a REST API for every document type through the Frappe framework, so an agent drafts a quotation or reads a stock level like any other integration. Tools can be offered through a provider's function calling or the open Model Context Protocol, and the gate behaves identically in both.

Long reasoning over contracts and documents usually goes to a large hosted model such as Claude or GPT. High-volume classification and speech run well on smaller self-hosted models, and anything that must stay in the building runs on open weights on your own hardware. Private LLM vs API sets out the trade-offs.

A fixed price to build, a measured cost to run.

The build is one fixed price, paid in milestones against the signed scope. The running cost is the part that varies: inference and hosting, estimated from your real volumes before you commit, and capped per run.

The tools and the evaluation set built for your agent are yours on full payment, with the rest of the source code. Warranty, hosting and data terms match everything else we build and are set out in pricing and engagement.

Bring one job to a first call, or describe it through the contact form. If a plain workflow would do it, you hear that before any quote.