AI agents
Custom LLM agents for B2B operations
What a custom agent is made of, where it fits in B2B operations, and the controls that keep its actions safe and checkable.
Key takeaways
- An agent is a model plus tools, data and a loop that decides the next step.
- Use a fixed workflow when the steps are known; use an agent when they are not.
- Give each agent the fewest tools and the narrowest permissions it needs.
- Require human approval before actions that are hard to undo.
- Treat every document or page the agent reads as untrusted input.
A custom LLM agent is a language model connected to your own tools and data, which plans steps and calls those tools to finish a task. It suits open-ended work such as triaging requests or extracting documents. Give it the fewest tools and permissions it needs, require human approval for high-impact actions, and log every step.
What is a custom LLM agent?
It is a language model connected to your own tools and data that decides, step by step, how to finish a task. A plain model call returns text; an agent can look something up, act on the result and check whether it is done.
Anthropic calls the basic building block "an LLM enhanced with augmentations such as retrieval, tools, and memory," and defines agents as systems where models "dynamically direct their own processes and tool usage."[1] "Custom" means the tools, data and rules are yours: your CRM, your ticketing system, your approval policy.
Definition
A tool is a function the agent may call, such as "look up an account" or "create a draft reply." The model chooses the tool and its inputs; your code runs it and returns the result.
What are the parts of an agent?
-
The model, which reads the goal, plans the next step and chooses a tool.
-
Tools, which are ordinary software functions with clear names, inputs and descriptions. Anthropic advises investing in the "agent-computer interface (ACI) through thorough tool documentation and testing."[1]
-
Context and memory, such as retrieved documents and the record of earlier steps in the run. Our guide to enterprise RAG pipelines covers the retrieval side.
-
The loop and its limits: the code that runs model, tool, result, next step, with stopping conditions. Anthropic gives "a maximum number of iterations" as an example.[1]
When is an agent the right choice?
When the steps cannot be scripted in advance. Anthropic recommends "finding the simplest solution possible" and separates agents from workflows, where models and tools follow "predefined code paths."[1] If you can draw the process as a fixed flowchart, build a workflow: it is cheaper, faster and easier to audit.
Autonomy also brings "the potential for compounding errors," which is why Anthropic recommends "extensive testing in sandboxed environments, along with the appropriate guardrails."[1]
Which of your workflows suit an agent?
A free growth diagnostic reviews two or three of your most time-heavy workflows, your data readiness, quick wins with the tools you already have, and the data and policy risks; you get the top 3 use cases ranked by value and effort. Your top 3 findings and a 30-day fix plan in writing within 2 business days.
Which B2B workflows suit an agent?
Work that is varied, text-heavy and checkable:
-
Support triage: read a request, look up the account, classify it, draft a reply and route it, with a person sending anything external.
-
Document intake: read an incoming purchase order or form, extract the fields, validate them against your records and flag mismatches for review.
-
Internal questions on data: turn a question into a query against an approved, read-only dataset and explain the answer with the query shown.
Illustrative sample
A hypothetical distributor receives purchase orders as email attachments in many layouts. An agent extracts the line items into a fixed schema, checks each product code and price against the catalog through a read-only tool, and creates a draft order. A person approves every draft before it reaches the ERP, and mismatches go to a review queue with the agent's notes.
How do you connect tools safely?
Treat every tool as code the model can run on your systems. The Model Context Protocol, an open protocol for connecting AI applications to tools and data, says tools "represent arbitrary code execution" and that hosts "must obtain explicit user consent before invoking any tool."[2] The specification also notes that MCP cannot enforce these principles at the protocol level, so your application has to.[2]
OWASP's Excessive Agency entry traces damaging actions to three causes: "excessive functionality," "excessive permissions" and "excessive autonomy."[3] Its mitigations map directly to design choices:[3]
-
Give the agent only the tools it needs, and keep each tool narrow; avoid open-ended tools such as shell access.
-
Scope credentials to the task, and run actions in the requesting user's context.
-
Enforce authorization in the downstream system, not in the prompt.
Where do humans need to approve?
Before anything hard to undo: sending external email, changing records of truth, moving money, deleting data or granting access. OWASP lists "Require user approval" for high-impact operations among its mitigations.[3] Anthropic describes agents that "pause for human feedback at checkpoints or when encountering blockers."[1] Set the approval rules in code, so a clever input cannot talk the agent past them.
How do you stop prompt injection?
Assume some input is hostile. OWASP explains that "indirect prompt injections occur when an LLM accepts input from external sources, such as websites or files," and says it is "unclear if there are fool-proof methods of prevention."[4] Its mitigations include enforcing least privilege, requiring human approval for high-risk actions, and segregating and identifying external content.[4] Our article on prompt injection security gateways covers the gateway layer.
How do you control data and quality?
Check each vendor's data terms. Anthropic says that by default it will not use inputs or outputs from its commercial products to train its models.[5] OpenAI says data sent to its API is not used to train its models unless you opt in, and that zero data retention is "subject to prior approval."[6]
For quality, build a test set of real cases before launch, log every step and tool call, and check claims in the output before people act on them. Our guide to AI hallucination verification covers the checking step, and our multi-agent orchestration guide covers what changes when one agent becomes several.
Our custom AI agents service covers these steps as part of our AI consulting work.
Sources
Written under our Editorial and AI Policy. Sources checked 19 Oct 2026. Reviewed by DGo Digital on 19 Oct 2026.
FAQ
Questions about custom LLM agents
A chatbot answers in text. An agent can also act: it calls tools such as a CRM lookup or a ticket update, reads the result and decides the next step. That ability to act is why agents need permissions, approvals and logs that a chatbot does not.