How to build an AI agent: build or buy, seven steps, cost drivers, and the risks Gartner, OWASP and Singapore's IMDA flag. A guide for business owners.
Quick answer: To build an AI agent for your business, pick one narrow, repetitive job, decide how you will measure success, connect the agent to the data and tools it needs, limit what it is allowed to do, keep a person in charge of risky actions, test it on real cases, launch to a small group and monitor it. Most failures come from skipping those steps, not from the technology.
An AI agent is software that is given a goal, decides which steps to take, uses tools such as your CRM, inbox or order system to take them, and checks its own progress. A chatbot mainly answers questions. An agent can also do things: look up an order, update a record, draft a reply, book a slot. That is why it is both more useful and harder to make safe.
OpenAI's practical guide to building agents says agents suit workflows involving complex decisions, unstructured data or brittle rule-based systems, where ordinary automation keeps breaking. If a job is a fixed sequence of steps with no judgement, a plain workflow tool is cheaper and more predictable. We compare the two in AI agents vs traditional automation, and the conversational side is covered in our guide to an AI chatbot for business.
Interest is real. A PwC survey of more than 300 US executives, run in April 2025, found that 79% said AI agents were already being adopted in their companies, and 66% of adopters reported increased productivity. It is a sample of larger US firms, so read it as a direction of travel rather than a figure for small businesses in Singapore or India.
Buy first if a product already does your job well. Build when your process, data or systems are unusual enough that off-the-shelf tools would force you to change how you work. The evidence leans towards buying: MIT's NANDA initiative reported, as covered by Fortune, that purchased tools and vendor partnerships succeeded about 67% of the time, while internal builds succeeded roughly a third as often. The report rests on a modest sample (about 150 interviews, a 350-person employee survey and 300 public deployments), so treat the gap as directional.
| Route | Best when | Main risk | Typical shape |
|---|---|---|---|
| Buy a ready product | The job is common (support, scheduling, lead capture) and a vendor already does it well | Limited customisation; you adapt to the tool | Subscription, configuration, light integration |
| Build custom | Your workflow, data or systems are unique, or the agent is part of your product | Higher cost, longer timeline, you own maintenance | Design, integration, testing and monitoring |
| Hybrid | A proven platform handles the basics and custom tools connect it to your systems | Integration breaks when either side changes | Configure the platform, build the connectors |
A decision matrix, not a ranking: the right route depends on how unusual your workflow is.
Gartner also warns about "agent washing": it estimates that only about 130 of the thousands of agentic AI vendors are real, with many relabelling chatbots, assistants and robotic process automation as agents. Ask any vendor to show the agent completing a task end to end on your kind of data. For a wider view of when each approach fits, see our guide to business process automation: workflow tools, RPA or AI agents, and for the build route our custom AI software development page explains how we scope it.
The order matters. Teams that start with the model and tools often discover too late that nobody agreed what "good" looks like. This is the sequence we recommend to a business owner or operations lead.
A narrow scope is the best predictor of a project that survives. If you are unsure which job to pick, our list of AI automation use cases for business and the walkthrough on automating a small business with AI agents show where small teams usually start. Gartner attributes the expected cancellations partly to unclear business value, which is exactly what a written metric prevents.
Connecting tools is where an agent becomes useful and where it becomes risky. OpenAI's guide recommends human intervention for high-risk actions such as cancelling orders, authorising large refunds or making payments, and a handover to a person when the agent exceeds a set number of failed attempts. The same guide advises starting with a single agent and moving to several only when needed. Connecting an agent to live systems is integration work as much as AI work, which is the focus of our automation and workflow engineering service.
From our work: we put the limit in the tools, not the instructions. In the AI command box inside our WhatsApp CRM, the assistant can search and tag contacts, create templates, look up orders and draft campaigns, but no tool exists that sends a message to a customer. A campaign it creates is always left as a draft for a person to send. Because the limit is structural, no clever wording from a user can talk it past that line.
Do not trust a demo. Salesforce AI Research's CRMArena-Pro benchmark found that leading agents reached only about 58% success on single-turn business tasks, dropping to about 35% in multi-turn settings (paper submitted May 2025, tested on the models of that time). Results will have moved since, but the lesson holds: success on easy prompts says little about success in a messy, multi-step customer conversation. OpenAI's guide suggests building the prototype with the most capable model to set a baseline, then swapping in smaller models to cut cost while checking they still meet your target. That only works if you have a test set.
Monitoring is not optional either. Agents depend on plumbing that fails quietly: tokens expire, rules change, third-party pages return something unexpected. Budget for someone to own the agent after launch, which is the point of an ongoing arrangement such as application maintenance and support.
There is no honest single number. Cost and time depend on the factors below, and a prototype is the cheap part. Gartner lists escalating costs among the three main reasons it expects projects to be cancelled, alongside unclear value and inadequate risk controls.
| Cost driver | Why it moves the price | How to keep it in check |
|---|---|---|
| Number of systems to connect | Every CRM, inbox, ERP or spreadsheet needs authentication, mapping and error handling | Start with one or two; read-only first |
| Data quality | Messy product, policy or customer data produces confident wrong answers | Clean the narrow set the agent actually needs |
| Autonomy level | More actions taken alone means more testing and safeguards | Draft-and-approve before auto-act |
| Volume and model use | Each model call, retry and tool lookup adds running cost | Use smaller models where tests show they are good enough |
| Testing and evaluation | Real-case test sets take time to assemble and score | Reuse past tickets and emails |
| Monitoring and upkeep | Integrations, policies and models change after launch | Name an owner; review logs weekly |
Cost drivers for a business AI agent. We give no price ranges because they vary too widely to be useful.
Timeline follows the same logic: a narrow agent with one or two integrations can reach a supervised pilot far sooner than a multi-system one with strict compliance needs. If a mobile or customer-facing app is part of the plan, that adds its own cost; see mobile app development cost for what drives it. Scope and price for any DXDasia project are confirmed in writing after a discovery call.
Most failures are not dramatic. The project had no metric, the agent was given too much access, or nobody was watching it. The figures below show how common these problems are.
| Finding | Figure | Source and year |
|---|---|---|
| Agentic AI projects expected to be cancelled | More than 40% by end of 2027 | Gartner forecast, June 2025 |
| IT application leaders with appropriate governance for AI agents | 13% (survey of 360 leaders) | Gartner survey, May to June 2025 |
| Leaders who see AI agents as a new attack vector | 74% | Gartner survey, May to June 2025 |
| Enterprise generative AI pilots reported as failing | 95% (small-sample study; read as directional) | MIT NANDA, reported August 2025 |
| Leading agents' success on business tasks | About 58% single-turn, about 35% multi-turn | Salesforce AI Research, May 2025 |
Selected figures on agent adoption risk. Each source is linked in the text and in the source list.
The governance gap is the clearest signal. In a Gartner survey of 360 IT application leaders, only 13% said they had appropriate governance structures for AI agents, and 74% saw agents as a new attack vector.
Prompt injection is when text the agent reads, from a user or from a web page, email or file, changes its behaviour. OWASP's guidance notes that no method is confirmed to fully prevent it. The UK's National Cyber Security Centre goes further: because models make no distinction between data and instructions, prompt injection attacks may never be totally mitigated, so it advises designing on the assumption the model can be fooled and giving it no more privilege than its input source warrants.
OWASP names the root cause of the damage "excessive agency": too much functionality, too many permissions or too much autonomy. Its fix is practical: offer only the tools the task needs, use least-privilege identities, and require a human to approve high-impact actions. Authorisation should sit in the downstream system, not in the model's judgement. If you want an outside review of an agent before launch, our security and compliance consulting covers it.
A Canadian tribunal held in February 2024 that Air Canada was liable for negligent misrepresentation after its website chatbot gave a customer wrong fare information, rejecting the argument that the chatbot was a separate entity. The principle travels: what your agent tells customers is treated as what your business tells them. Limit it to approved sources and give it a way to say that it will pass the customer to a person.
If the agent touches personal data, privacy law applies from the first prototype. Singapore's PDPC advisory guidelines on AI recommendation and decision systems say organisations can generally use personal data where there is meaningful consent, or rely on exceptions such as business improvement or research. They also say service providers building bespoke systems on your behalf can take on the role of data intermediaries, with their own PDPA obligations. The guidelines are framed around systems that recommend or decide and do not specifically discuss generative AI, so take advice on any agent built on a language model. Our summary of data privacy in the AI era is a good starting point.
On 22 January 2026 IMDA launched a Model AI Governance Framework for Agentic AI. As summarised by Allen & Gledhill, it asks organisations to bound risks upfront by limiting an agent's tools and access, to make humans meaningfully accountable with approval checkpoints for high-stakes or irreversible actions, to test before deployment and monitor afterwards, and to tell end users what the agent can do. It is guidance rather than law, and it maps closely onto the build steps above.
We build and run agents, and the lessons below come from our own products rather than from theory.
Safety by design, not by prompt. In the AI command box in our WhatsApp CRM, clients type a request and the assistant acts through tools: it can search and tag contacts, create templates, look up orders and draft campaigns. It cannot message a customer, because no send-capable tool exists in its tool set. Campaigns it creates stay as drafts for a person to send. That is a structural limit, so no instruction or injected text can get round it.
Approval windows, not endless queues. In our Google Business Profile management tool, drafted review replies and posts send automatically after a visible countdown unless someone edits or skips them, and the team is notified once when a batch is queued. Only the risky slice, such as replies to one and two star public reviews, stays behind a manual gate. A human gate that never times out defeats the point of automating.
The failures are usually plumbing. Our daily Google Ads monitor went dark because Google expires OAuth refresh tokens after 7 days when the app is left in Testing status. The durable fix was a service account added to the ad accounts as a user, which never expires. Separately, a hosted chatbot went dark because of a CDN security rule and an expired credential, not a model problem. Monitor tokens, DNS and CDN rules and database quotas, not just the AI.
Trust is earned before autonomy. For client reporting and content drafts, we keep AI-generated output admin-only by default; one deliberate click publishes it and sends the client notification. Our published work includes a chatbot and support automation platform with 70% fewer support tickets and the WhatsApp AI agent suite.
Build less than you think you should, and constrain more than feels necessary. Our recommendation is to buy or configure a proven product for common jobs, build custom only where your workflow is genuinely different, and in either case start with one job that has a written metric. Treat human approval as a design feature that you relax with evidence, not an apology at launch. The evidence above is consistent: projects fail on cost, unclear value and weak controls, and the cheapest protection is a narrow scope with limited tools. Read the numbers with care, though. Several come from large-company surveys or benchmarks of older models, and your own test set will tell you more than any of them.
We design and build business agents through our agentic AI development and integration service, and we run a planning phase through AI consulting and strategy for teams still deciding what to build or buy. If you are new to the idea, our explainer on what an AI automation agency does sets out the scope, and our Singapore team page covers local delivery. To talk through a specific job, contact us for a discovery call.
It depends on scope. A narrow agent with one or two integrations can reach a supervised pilot much sooner than a multi-system agent with strict compliance needs. The slowest parts are usually connecting systems, assembling a real test set and agreeing approvals, not writing the first prototype. We confirm timelines in writing after a discovery call.
For a simple agent on a ready platform, a capable operations person can configure one. Anything that touches customer data, payments or several systems needs engineering for authentication, error handling, logging and testing. Many businesses configure the basics themselves and bring in developers for the integrations and safeguards.
Choose a frequent, time-consuming task with a clear start, finish and measurable outcome, such as answering order-status questions, qualifying enquiries or drafting first replies. Avoid anything where one wrong action is costly or irreversible until you have evidence the agent performs reliably.
No. Traditional automation follows fixed rules and fails when input varies. An agent decides which steps to take using a language model and tools, so it copes with unstructured input but behaves less predictably. Many good systems combine both: rules for the predictable parts, an agent for the messy ones.
You cannot remove mistakes entirely, so limit their impact. Give the agent only the tools it needs, require human approval for high-stakes actions, test on real cases before launch, log every action and review the logs. Design the limits into the system, not only into the instructions.
The PDPA applies whenever an agent handles personal data, and the PDPC has published advisory guidelines on AI systems that recommend or decide. IMDA also published a Model AI Governance Framework for Agentic AI in January 2026, which is guidance rather than law. Neither replaces legal advice for your sector.
Usually buy or configure first. Common jobs such as support, booking and lead capture are well served by existing products, which are faster to launch. Build custom only when your workflow, data or systems are unusual, or when the agent is part of what you sell. A hybrid approach is common.