An AI Agent for Your Business: What It Is, When It Pays Off, and How to Scope One Safely

What an AI agent is

The vendors building the models define it similarly. OpenAI's guide to building agents puts it simply: "Agents are systems that independently accomplish tasks on your behalf." Anthropic draws the line that matters for a business owner: workflows are "orchestrated through predefined code paths", while agents are systems where the model dynamically directs its own process and tool use. Google Cloud describes agents as software that uses AI to pursue goals and complete tasks on behalf of users.

In practice an agent is three things wired together: a model that reads the request and decides, a set of tools it may call (search the CRM, read an order, draft an email, create a task), and rules about which of those tools it may use alone and which need a person to approve.

Agent, chatbot or automation?

Most requests I get for "an AI agent" are really for one of the other two, and that is good news, because the other two are cheaper and more predictable. A chatbot answers questions from a knowledge base. An automation runs the same steps every time a trigger fires. An agent is for the cases in between, where each request needs a decision about what to do next. Gartner's Anushree Verma put it bluntly in a June 2025 release: "Many use cases positioned as agentic today don't require agentic implementations."

The same Gartner release predicts that over 40% of agentic AI projects will be cancelled by the end of 2027, citing escalating costs, unclear business value or inadequate risk controls. That is not an argument against agents; it is an argument for scoping them tightly.

Realistic uses for an Israeli business

The strongest cases share one trait: messy input that a person currently reads and sorts by hand. None of them needs the agent to act alone on anything that is hard to undo.

• Hebrew-language support: reading customer messages in Hebrew, slang and all, finding the order, and drafting a reply for a person to send.
• Lead qualification: asking the two or three questions that separate a real inquiry from a price check, then routing it with a summary.
• Internal knowledge assistant: answering staff questions from your own procedures, price lists and past emails, with a link to the source.
• Back office: reading supplier invoices or delivery notes and preparing entries for someone to approve.

Does it work in Hebrew?

Mostly yes, but test it on your own conversations rather than trusting a language list. Anthropic says Claude handles input and output in most languages that use standard Unicode characters, though Hebrew is not one of the languages in its published benchmark table. Google lists Hebrew among the 99 languages of the Gemini Live API. Take twenty real customer messages, including the short and the rude ones, and check the answers before you decide.

A first-hand example: how DMonitor handles untrusted text

DMonitor is the agent I built to run my own business: more than 30 tools behind one Telegram chat, running on Cloudflare Workers with Supabase, reading live data from Google Analytics, Search Console, PageSpeed, Sentry, UptimeRobot and the Airtable CRM. The hardest design problem was not the tools. It was that some of the text the agent reads was written by strangers: a lead's message from the public contact form, a search query someone typed into Google, a web page. Any of it can contain an instruction aimed at the model. One live Search Console query did.

So trust is tracked per turn, by content. Five read tools return text that outsiders can write — lead records, CRM pipeline records, Search Console queries, Sentry issue titles and web search results — and calling any of them marks the turn as tainted. After that, the nine tools that change something (send an email, create a lead or a CRM prospect, save or delete a memory, edit a template, update the roadmap, resolve an error, purge the site cache) refuse to run and ask me to restate the action in a new message. Forwarded messages are blocked from those tools outright. It costs me one extra message now and then; it means a sentence hidden in a form submission cannot send an email in my name.

How to scope an agent

A good scope fits on one page. If it does not, you are describing several agents, or an automation with an agent step inside it.

• One job, in one sentence, with the person who does it today.
• The inputs it reads, and which of them strangers can write.
• The tools it may call, split into "read freely" and "act only with approval".
• What done looks like, and what it should do when it is not sure — usually hand over to a person.
• Where every conversation and tool call is logged, and who reads the log.

The risks, and what to do about each

Hallucination: models state wrong things confidently. Anthropic's own guidance is to let the model say it does not know, to ground answers in direct quotes from your documents, and to verify with citations — and it says plainly that these techniques reduce hallucinations but do not eliminate them. So anything customer-facing either quotes a source or goes through a person.

Prompt injection: the OWASP Top 10 for LLM applications lists it first, as LLM01:2025, and lists "Excessive Agency" — giving the model more power than the task needs — as LLM06. The defence is the one described above: limit the tools, and require approval for actions once outside text is involved.

Privacy: every message the agent reads is sent to a model provider. Amendment 13 to Israel's Protection of Privacy Law has been in force since 14 August 2025, so know which provider processes the data, under which terms, and send only what the task needs. If you serve customers in the EU, the AI Act's transparency rules, in effect from August 2026, require that people are told when they are talking to a machine.

What the cost depends on

There is no single price for "an agent", because the cost is made of parts that scale differently. Model usage is billed per million tokens, and the spread between models is large. On the providers' pricing pages on 30 September 2026, per million input / output tokens: Gemini 3.8 Flash $0.75 / $3.75 (a promotional price until 31 December 2026, then $1.50 / $7.50); Claude Haiku 4.5 $1 / $5; Claude Sonnet 5.5 $2 / $10; OpenAI's gpt-6-luna $0.10 / $0.50 and gpt-6-astra $10 / $50. Most business agents run the bulk of their work on a small model and call a large one only when needed.

• Tokens: how many messages, how long they are, and how much context each call carries.
• Integrations: each system the agent reads or writes needs API access, and some vendors charge for it or limit it by plan.
• Hosting: small agents often fit in serverless platforms — Cloudflare Workers, for example, allows 100,000 requests a day free, with paid plans from $5 a month.
• People: the time someone spends reviewing drafts and approving actions — often the biggest line, and the one that shrinks as trust is earned.
• Maintenance: model versions change and prices move, so plan for periodic re-testing.

How to measure success

Measure the manual process for two weeks before the agent goes live; without a baseline, every result looks good. Then track the same numbers, and read a sample of real conversations every week — the numbers tell you how much, the transcripts tell you why.

• Time to first response, before and after.
• Share of requests finished without a person, and share handed over.
• Corrections: how often a person had to change the agent's draft or decision.
• Cost per handled request, including model usage and review time.