43 failures. Then 250,000 GitHub stars in 2 months: How business skills for AI agents save weeks of production work

I'm Denis Shokhirev, Agentic AI Systems Architect in Freiburg im Breisgau (DennisCraft AI Studio, stack: Claude, Supabase, n8n, Doppler, self-hosted Postgres). My first production multi-agent system crashed a client backend 43 times in one week. Two months later, a public fork of the same agent stack hit 250,000 GitHub stars. The difference wasn't smarter LLMs, but business skills for agents: defining what matters to the business, not just the code.

Why demo agents fail in production

Most LLM agents ace demo day, then break when exposed to real logistics or fintech data. I've watched Claude Code-based agents pass internal QA, but in live deployments:

They generate SQL queries with SQL injection risks—OWASP Top 10, 2017
They loop endlessly when an API is down, racking up cloud costs
They lose track of business context—e.g., invoice bots bill the wrong client because they don't validate tax IDs

The root cause: lack of business skills. Agents don't know when to stop, how to validate data, or which errors are show-stoppers for the business.

How to formalize business skills for AI agents

1. Explicit business constraints in prompts

Every agent needs to know: what actions are permitted, resource/time limits, and what “success” looks like. This isn't just for LLMs—it's for any agent acting on your behalf.


# Example: Claude Code, explicit API call limit
PROMPT = f"""
Your task: check order status.
Constraints: no more than 2 API calls per task, do not store personal data.
On error — retry only once, otherwise fail the task.
"""

Adding these constraints slashes infrastructure costs and reduces agent “runaways.”

2. Action chain validation—business rules, not just code correctness

n8n lets you map agent flows and insert business rule validators at any step.


# n8n workflow: validate tax ID before sending invoice
- name: get_client
  type: postgres
  params: {query: "SELECT tax_id FROM clients WHERE id = $id"}
- name: validate_tax_id
  type: function
  params: {code: "if (!isValidTaxId(item.tax_id)) { throw Error('Invalid tax ID') }"}
- name: send_invoice
  type: http
  params: {url: "https://api.invoice/send"}

Validation errors block the workflow and prevent costly business mistakes.

Where vanilla LLM agents fall short

Agent Type	Strengths	Missing Pieces
Vanilla LLM Agent	Code generation, Q&A	Budget awareness, SLA, business validation
Agent with business logic	Respects constraints, validates business rules	Needs more external system integration
Hybrid: LLM + static analysis	Catches SQL injection, token leaks (semgrep, bandit, gitleaks)	Runtime understanding of business KPIs

How to save weeks on production AI work

1. Static code analysis at every step

I run semgrep, bandit, and gitleaks on every agent-generated pull request (semgrep, bandit). LLM agents regularly output subtle code smells, only caught by these tools in CI/CD or at codegen.


# Run semgrep + bandit in CI
semgrep --config=python .
bandit -r .
gitleaks detect

On a recent deployment, 5 critical token leaks were caught—before hitting production.

2. Split agent roles—no “one agent fits all”

I never let a single agent run the entire workflow. One agent handles communication, another validates documents, a third makes final decisions. This isolates failures and prevents cascading errors.


// n8n: different agents for different steps
[
  { agent: "document_validator", input: "invoice.pdf" },
  { agent: "business_rule_checker", input: "validated_invoice" },
  { agent: "notifier", input: "approved_invoice" }
]

3. Full audit logs—track every agent action

I log all agent actions to Supabase/Postgres, not just stdout. This lets me spot bottlenecks, audit for compliance, and debug faster.


import supabase
# Log agent action
supabase.table("agent_logs").insert({
   "agent": "validator",
   "action": "tax_id_check",
   "status": "fail",
   "timestamp": datetime.now()
})

FAQ

Which static analysis tool best catches LLM agent errors?

semgrep (https://semgrep.dev/) is the most flexible and fast for Python generated by Claude or OpenAI. Pair with bandit for security, gitleaks for secrets.

How do you encode business constraints for agents?

Explicitly in the prompt: resource/time/budget limits, retry logic, and success criteria. Enforce in the workflow via functions or validation steps.

How do you log agent actions for auditing?

Use Supabase or self-hosted Postgres. Log both errors and successful actions for compliance and debugging.

Should each business rule have its own agent?

No, but for critical steps (validation, approval, client delivery), use specialized agents to contain risk and simplify debugging.

How can you quickly check an agent isn't violating business constraints?

In n8n, add manual or automated validation steps at key points in the workflow. Use Python/JS functions to check limits in real time.

At which stage do your agents most often break: code generation, API integration, or business validation? I’d genuinely like to know.

I run a free 30-min stack audit for DACH founders building AI in regulated markets. DM me on LinkedIn or write to @ger_dennis_ai.