Most AI agent development is sold on what the agent can do — book the meeting, chase the invoice, triage the inbox.
What separates a demo from a production system is the opposite list: what the agent is not allowed to do without a human, what it records about every decision, and what happens when it is wrong.
We write that list first and build to it.
The boundary is specific. Anything irreversible — money leaving an account, a record being destroyed, a message reaching a customer, a limit moving — waits for a human, every time.
Everything the agent decides is written down at decision time with enough context to replay it, so “why did it do that” is answered from the log, not reconstructed from memory.
And any step that follows a fixed rule stays deterministic code: an agent that asks a model to add numbers or look up a record has a reliability bug designed in.
This is also how this firm builds: agents write the code here, under the same gates this page describes.
Ask any shortlist how their own delivery runs — a firm selling agents that does not run on them is asking you to buy something it will not eat.
A workflow that follows a fixed rule wants automation, not an agent. An agent is the expensive answer, and it is only the right one where a judgment call sits inside the loop.
Scope
What the agent may do on its own, what waits for a human, and what it may never touch — agreed in writing before build starts.
Money out, data deleted, a customer contacted, a limit raised: gated by default, and removing a gate is a written change order, not a config flip.
A lookup is a lookup and arithmetic is arithmetic.
The model is called only where a judgment is genuinely required — reading an ambiguous document, choosing an escalation path — never as the system of record, and never to compute a value a database already holds.
Each action is recorded with the prompt, the retrieved context, the tool calls and the output, so “why did it do that” has an answer months later — for you, for an audit, or for a regulator.
An agent whose decisions cannot be replayed is one you cannot debug and should not trust.
The model will be wrong; the build assumes it. Tool errors retry against a cap, ambiguity escalates to a person instead of guessing, and a kill switch stops the agent without stopping the business. Failure paths are exercised before launch, not discovered by a customer.
A written runbook, alert thresholds, the gate configuration, and a tested rollback path. Your team can change a prompt, tighten a limit or shut the agent off without calling us — and nothing in the delivery depends on a licence we control.
Mostly not the model. An agent is a model wired to tools with a permission boundary around it, and the engineering weight sits in the boundary: tool definitions, human gates, logging, failure paths, rollback.
An AI agent development company that talks only about which model it uses is describing the smallest part of the system. Ask instead what the agent is not allowed to do, and where that is written down.
When someone in your business can state the rule. “If the invoice is over the limit, route it to finance” is workflow automation: cheaper to build, deterministic, testable, and identical on every run.
An agent earns its cost only where a judgment call sits in the loop and the inputs are too varied to enumerate in advance. If your workflow is rules all the way down, the simpler build is the right one.
Done properly, AI agent development services cover scoping the permission boundary, building the agent and its tools, evaluating it against your real cases before launch, and handing over the runbook, with the excluded cases named one by one in the scope document.
The version to walk away from is a demo priced as a product: it works on the happy path, and the malformed input, the empty API response and the ambiguous record are all left as your problem after the invoice.
Yes, and the difference is consequence. A chatbot produces text; when it is wrong, someone reads a bad answer. Agentic AI development produces actions. The system sends, schedules, files, updates, spends.
Being wrong now has a blast radius, which is why the gates, the logging and the rollback path are not enterprise decoration. They are the actual work.
Structurally, not with prompt wording. The agent can only call tools it has been given, each tool enforces its own limits, anything irreversible waits for a human, and a kill switch stops it cold. “We told it to be careful” is not a control.
An instruction in a prompt can be overridden by a cleverly worded input, but a tool the agent does not have cannot be misused.
Yes. Code here is written by agents behind the same gates this page describes, so the setup we would build for you is the one we already run.
The boundary document sets the price: a fixed fee, milestone-billed as verified work lands, never by the hour.
The biggest cost driver is how many irreversible actions the agent touches: every gate, log and rollback path is real engineering, and an agent that only reads is far cheaper than one that spends.
Retainers end on 30 days written notice from either side, with no minimum term. Milestone billing means you never pay ahead of delivered work.
The start date is set in the signed scope, and work begins as soon as the deposit clears.
Founder, Provingmark
Thirty minutes, no charge.
Related: Case study: Neleus · What an AI agent costs to build and run · AI workflow automation · LLM & RAG integration · AI consulting · AI governance · How we work