An AI agent or an automation is easy to demo and hard to judge. Before you sign with anyone who will build one for your business, get written answers to eight questions: what exactly will be built and what counts as done, who owns the result, where your customers' data goes, what the agent may do on its own, what happens when it breaks, how you leave, what the platforms bill you directly, and who has built something similar before. A vendor who answers all eight with specifics is a better bet than one with the best demo. Each question below comes with what a good answer sounds like. Ask us the same eight.
1. What exactly will be built, and what counts as done?
A good answer is a one-page scope: what triggers the work, the steps, which of your systems it touches, and the 20 real cases it must handle correctly before launch. The auto-reply post shows how to build that test set from a two-week count of your own messages. Tie a fixed price, agreed before work starts, to that scope. “We will work it out as we go” is a reason to wait.
2. Who owns what you pay for?
Do not assume it is you. Under section 35(a) of the Copyright Law, 5768-2007, the creator of a commissioned work is its first copyright owner unless the person who ordered it and the creator agreed otherwise, expressly or by implication. The same law counts a computer program as a literary work. So ask for it in writing: an assignment, or a licence you can live with, covering code, prompts and configuration.
Ask too that every account is opened in your name, with you as administrator: the automation platform, the WhatsApp Business account, the domain. In Make, for example, a scenario can be exported as a .json blueprint, but the blueprint carries no connections, which have to be set up again in the account that imports it.
3. Where does your customers' data go?
A vendor who can read your customers' names, numbers or messages is an outside party with access to your data. Regulation 15 of the Privacy Protection (Data Security) Regulations, 5777-2017 tells a database owner who gives an outside party access to assess the risks first, and to write into the agreement, among other things:
- the data and purposes allowed, the systems the vendor may reach and the kind of processing;
- how long the work lasts, and how the data is returned and destroyed at the end;
- who else may touch the data, and a duty to report on compliance and to tell you of a security event.
The regulation reaches most business databases, but not a contract with an individual and, as a rule, not a database run by one person with at most two other authorised users (regulations 15(c) and 21). Ask for a list of every sub-processor and the country where each stores data, and ask a lawyer which group you are in. This is our plain-language reading, not legal advice.
4. What may the agent do on its own?
List what an agent could do: reply, book, edit a record, send a quote, issue a refund. Mark each as automatic or approved by a person first. OWASP's guidance on excessive agency says to limit the tools an agent may call and the permissions it holds to the minimum necessary, and to have a person approve high-impact actions before they happen. Start with an agent that reads and drafts. Widen its rights only after the test cases pass.
5. What happens when it breaks?
Every automation fails sooner or later. Ask who receives the alert, how quickly a person looks at it, how a failed run is replayed without doing the work twice, and who the named owner is after launch. When an automation breaks covers the alert and replay options in Zapier and Make.
6. How do you leave?
Ask what you receive on the last day: exports, documentation, a short runbook written for someone who did not build it, and the account transfers. Ask for the notice period, and whether anything stops working if you leave.
7. What do the platforms bill you directly?
Much of the running cost of an agent is paid to the platforms underneath it, not to the builder: the automation platform, the model provider, the messaging channel. Ask for a list of each one, what drives its bill (messages, runs, usage) and whose card it goes on. You should be able to answer what happens to the bill if your volume doubles.
8. Who has built something like this, and can you talk to them?
Ask for a reference you can call, or a working example run on your own messages instead of the vendor's sample ones. Then ask what the thing will not do. An honest builder has a list, and gives it to you before you sign.
How do we help?
We build AI agents and automations, with a fixed price agreed before work starts. Bring these eight questions to a free intro call and ask us each one.
Sources
- Copyright Law, 5768-2007, sections 1 and 35, Hebrew Wikisource, text read on 21 October 2026. A transcription of the official text; its header links the Knesset PDFs.
- Privacy Protection (Data Security) Regulations, 5777-2017, regulations 15 and 21, Hebrew Wikisource, text read on 21 October 2026. The official Reshumot publication is Kovetz HaTakanot 5777, page 1022. We found no later amendment; check the current text before relying on it.
- Blueprints, Make Help Center, read on 21 October 2026.
- LLM06:2025 Excessive Agency, OWASP Gen AI Security Project, read on 21 October 2026.