AI agents: how to connect a model without it messaging a customer on its own

AI agents is what this article is about, even when the technical tool has another name. For a renovation contractor the day looks like this: quotes in WhatsApp, photos in a camera roll, and job status in the foreman’s head. The agent sorts incoming messages, drafts a reply and marks what is urgent. It does not send anything to a customer before you approve it. The message lands in the information system, the agent suggests a plain reply, and you approve or correct it in one pass. The agent sits on the information system and on the WhatsApp bot. Without the system it answers in a vacuum. Without the bot the customer stays in a separate chat. The agent sees only the files of the role you approved, not the whole business. The agent does not close a deal, change a price or delete a record. A person keeps those. The rest of the article is how a software house builds that without leaving the team with a demo.

Large language models are probabilistic components in deterministic systems. Treat them like powerful, occasionally surprising collaborators: give narrow jobs, validate outputs, and never let them be the sole gate on irreversible actions without policy.

Architect boundaries first. Authentication, authorization, billing, and durable state belong in application code you control. The model layer should consume curated context and return drafts or structured suggestions. That separation makes provider swaps, offline tests, and incident isolation tractable.

Prompt programs are code: version them, review them, and test them. Check in templates with variables; avoid “prompt craft” living only in a chat transcript. For regressions, keep golden sets-anonymized inputs with acceptable output ranges-and run them when models or prompts change.

Grounding with retrieval (RAG) reduces confident fiction but introduces pipeline risks: stale documents, wrong chunking, and attribution errors. Engineer retrieval like search-hybrid lexical + vector, metadata filters, re-ranking, and citation of sources in UI when users need to verify.

Structured outputs must pass schema validation. JSON mode, tool or function calling, and grammars can help, but your service should still reject impossible states. Use coercion carefully; better to ask the model to repair than to silently cast types.

Context economics dominate cost and latency. Summarize long threads, trim irrelevant history, and batch independent classifications. Profile token usage per feature; surprises often hide in verbose system prompts or accidentally attached attachments.

Caching and idempotency help high-volume features. Hash prompts with stable canonicalization; respect PII-never cache sensitive content in shared layers without policy. For user-specific personalization, isolate caches or disable cross-tenant reuse.

Safety is layered: blocklists are insufficient; combine instruction hardening, tool allowlists, output scanning, and human review for sensitive domains. Prompt injection from untrusted documents demands separation of system instructions from user content-delimiters help but are not foolproof; validate tool arguments as if they came from the internet.

Privacy and vendor handling require deliberate choices. Understand provider policies on retention, logging, training use, and enterprise controls (including zero or minimized retention options where contractually available). Classify data before it crosses a network boundary; many incidents start with “we did not think this was sensitive.”

Observability for LLM features includes latency, error rates, token usage, refusal patterns, and user corrections. Sample traces for quality review; automate privacy redaction in your logging pipeline. Tie model quality to business outcomes-not just helpfulness scores.

Operational patterns mirror microservices: retries with backoff, circuit breakers when providers degrade, and graceful degradation to simpler models or templated responses. Feature flags let you dark-launch prompt changes and roll back fast.

Human-in-the-loop remains essential for compliance, brand risk, and high-stakes automation. Decide where drafts stop and approvals begin; store rationale and diffs for audits where required.

In summary: integrate LLMs as managed components-bounded context, validated structure, grounded knowledge where needed, safety depth matched to risk, and telemetry that connects spend to outcomes. Mature teams ship fewer “magic demos” and more boring, reliable assistants.

You can come back from here to a plain conversation: Bring ten real messages from this week, without names if you must, and the reply you would have sent yourself. In the morning you see a queue of drafts, not an endless inbox. What you approved yesterday already went out. The rest is waiting. AI agents, an information system and a WhatsApp bot stay the same offer, with human approval, from an official Meta provider.