n8n as an AI Agent Harness: A Practical Business Guide

n8n in Practice · Part 2 of 4

A customer emails about a missing order. An n8n agent can look up the account, check shipment details, and draft a response. Your workflow can require approval before anything gets sent.

The connections, permissions, and checks surrounding the model are its agent harness. n8n gives us a visual way to put those pieces together, decide what the agent can do, and handle the cases that need a person.

We’ll follow that support example through the design. It’s an illustrative workflow, not a claim about a client deployment. The newer Agents and AI Assistant features are in Preview; current self-hosted limitations are summarized below.

What an agent harness means

For our missing-order example, the model needs access to current records, a way to ask for more information, and clear limits on actions such as refunds. We configure those capabilities around it:

• Instructions and model: understand the request, check the available evidence, and explain uncertainty.
• Tools and knowledge: look up the customer’s order, check shipment status, and retrieve the applicable support policy.
• Memory: keep track of what the customer has already told us during the conversation.
• Controls and records: verify identity, restrict access, review the proposed response, and record what happened.

A stronger model may improve interpretation, but we still have to build those connections and enforce the business rules.

Three n8n AI features with different jobs

n8n now uses similar language for three features. Understanding the difference prevents a great deal of confusion.

The AI Agent node is the right building block when one stage of a workflow needs model-directed tool use. The newer Agents area is designed for assistants that people contact through chat or channels and that may run scheduled tasks. The AI Assistant helps a person build; it is not the agent serving the final user.

Choose an agent, a fixed workflow, or a hybrid

Use fixed workflow logic when the business rule is already known. Required fields, dollar limits, date calculations, duplicate checks, database writes, and audit records usually belong in deterministic nodes. Their behavior is easier to inspect and test.

Use an agent where the input is open-ended and the correct next action depends on meaning. An agent can interpret a request, decide which lookup is relevant, ask a follow-up question, or choose among several narrowly defined tools.

For the support example, we would use a hybrid. The agent interprets the email and drafts a response. Fixed workflow steps check the customer identity, load permitted records, enforce approval, and send the approved message.

Models, tools, knowledge, and memory

The model

Model choice affects response quality, tool calling, latency, privacy, and cost. A large hosted model may handle complicated instructions well. A smaller model can be faster and less expensive for classification or extraction. A compatible local endpoint can keep inference under your control, subject to the behavior of the integration and every other connected service.

Black Swamp AI works with hosted providers and locally served open models. We test the exact model against the required tools and examples. A model that writes good prose may still produce weak structured output or choose tools inconsistently.

The tools

Tools turn a response into work. n8n agents can use supported integrations, workflows in the project, custom tools described with a JSON schema, and external tools exposed through MCP servers. The tool description tells the model when to use it, while its schema describes the expected inputs. The tool or receiving service must validate those inputs and enforce permissions before acting. A schema alone is not a security boundary.

A tool should do one clear job and use credentials with the smallest practical permissions. For our support agent, “look up an order for this verified customer” and “retrieve shipment status” are clearer choices than a general-purpose tool that can change any order.

Knowledge and retrieval

Knowledge supplies material the model can search when answering a question. In the first-class Agents feature, n8n currently accepts CSV, PDF, Markdown, and text files. A workflow can also retrieve records from databases, vector stores, APIs, or another workflow.

Retrieval does not automatically enforce the permissions of the original source. The workflow must identify the requester and filter documents or records accordingly. Returned text can also contain instructions that conflict with the agent’s job, so retrieved content should be treated as data.

Memory

Memory helps continue a conversation. The current Agents feature keeps session context by default and offers optional episodic memory for information from earlier sessions. That episodic memory currently requires an OpenAI credential, an important dependency to check if the goal is a fully local installation. AI Agent workflows can connect to memory components backed by services such as Redis or PostgreSQL, depending on the design.

Memory should not become the system of record. Customer status, inventory, prices, permissions, and approval state should come from the authoritative application. Decide how long conversational history is retained, who can retrieve it, and how a person can correct or remove it.

Put human approval around consequential tools

The AI Agent workflow node can pause before executing a selected tool and show a reviewer the proposed tool and parameters. Current approval channels include n8n Chat, Slack, Discord, Telegram, Microsoft Teams, Gmail, WhatsApp, Google Chat, and Outlook.

Approval belongs closest to the action. A reviewer deciding whether to send an email should see the recipient, subject, and body. A reviewer approving a CRM update should see the record and proposed changes. A generic “continue?” prompt provides little protection.

Useful approval candidates include external messages, purchases, refunds, deletions, access changes, legal or personnel decisions, and high-value record updates. Read-only searches may run automatically when their credentials and returned data are appropriately limited.

Denial is part of the design. Tell the agent whether it should ask for corrected information, offer a safer action, create a task for manual handling, or stop. Design an expiry or escalation path for unanswered requests using the capabilities of your chosen approval step, and assign someone to handle them.

Example: from missing-order email to approved response

Here’s how the pieces fit together. This is a design sketch, not an exported n8n workflow or a benchmark.

Illustrative support workflow

1. 1. Receive and verify
   Email arrives → validate the request and verify access to the customer’s records.
2. 2. Agent investigates
   Model + instructions + conversation memory
   ↳ Limited tools: order lookup, shipment status, support policy.
3. 3. Check and review
   Validate the proposed response → a person approves, requests changes, or rejects it.
4. 4. Act and record
   Send only the approved response → update the ticket and record the outcome.
   No approval or unresolved uncertainty → assign a human task instead.

Suppose the carrier reports a delay but the customer asks for a refund. The agent can summarize both facts and retrieve the refund policy. It should hand the decision to the designated reviewer rather than invent an exception or issue a refund with broad account credentials.

Before sending, the workflow checks that the recipient and message still match what was approved. It also needs duplicate protection: use a stable idempotency key where the receiving API supports and enforces it. Otherwise, build reliable duplicate protection around the action and handle uncertain outcomes before retrying. Merely adding a key to a request does not prevent a second send.

If the order cannot be found or a lookup fails, create an assigned support task with the available context. Record the request, relevant model and prompt versions, tool calls, approval, and outcome without retaining unnecessary customer data.

Test behavior, permissions, and cost

A successful response in the editor proves one path. Build a small evaluation set with normal requests, vague requests, missing data, conflicting instructions, unauthorized users, tool errors, and attempts to trigger prohibited actions. Record the expected action as well as the expected wording.

n8n supports light evaluations during development and metric-based evaluations for larger test sets. Compare prompt or model changes against the same cases. Add real failures to the set after removing sensitive data. This creates a regression check for future changes.

Operational monitoring should answer more than whether the workflow completed. Track whether the intended business result occurred, which tools ran, which approvals waited or expired, how long each stage took, and what the model and connected APIs cost.

Understand the bill

The newer first-class Agents feature counts one user-to-agent turn as one n8n execution, and those turns share the plan’s execution quota with workflows. An AI Agent node inside a published workflow follows the workflow’s production execution accounting described in Part 1.

On n8n Cloud, the builder Assistant uses its own credit allowance; that is separate from running your customer-facing agent. A self-hosted Assistant uses your configured model endpoint, so budget for provider usage or local inference, plus sandbox infrastructure.

The n8n execution allowance or charge is only one part of cost. Model tokens, embeddings, reranking, search, messaging, storage, and other tool APIs may have their own charges. An agent may make several model or tool calls during one turn. Measure cost per completed business result and set limits for loops, context size, output length, and expensive tools.

Keep credentials and data scoped

Attach separate credentials for the agent where practical and grant only the permissions its tools require. Filter tool results before returning them to the model. Avoid placing secrets in prompts, memory, execution logs, or approval messages.

With a hosted model, the prompt and selected business data leave your environment under the provider’s terms. A locally served model can keep inference on infrastructure you control, while web search, messaging, storage, and other tools may still send data elsewhere. Map the complete data path before deployment.

Current Preview details for self-hosted n8n

As of September 7, 2026, the newer Agents feature and AI Assistant are in Preview. These are the main self-hosted planning constraints:

• Agents: documented from n8n 2.32.3 with the agents module enabled. Queue mode is not supported yet, and channel connections can fail in that configuration. Self-hosted Enterprise support is not ready.
• Knowledge: the newer Agents feature’s self-hosted knowledge bases require a Daytona sandbox and are also in Preview.
• Builder Assistant: uses the separate instance-ai module and requires a sandbox for generated code. n8n documents its bundled sandbox for development and testing and recommends Daytona for production. Web search is optional.

These limits should not be applied to every workflow containing an AI Agent node. The builder’s sandbox also does not automatically isolate the tools your running agent calls. Check the Agents documentation and self-hosted Assistant setup against your deployment before choosing a design.

How Black Swamp AI helps

We help businesses choose where an agent adds value, connect it to the right systems, and keep its authority understandable. A project can include workflow design, private node development, local or hosted model integration, approval paths, evaluations, deployment, monitoring, and maintenance.

The first deliverable is usually a narrow, testable workflow around one business outcome. It gives us real inputs, exceptions, and costs before expanding the agent’s tools or audience.

Explore our automation services, review our n8n integrations and workflows, or discuss an agent project.

Sources and review notes

• n8n AI Agent node
• Build and manage first-class Agents
• Human approval for AI tool calls
• Testing and evaluating AI workflows
• Using the AI Assistant
• Self-hosted AI Assistant and Agents setup
• MCP servers as agent tools

Features and documentation reviewed September 7, 2026. Preview behavior and availability can change.

Researched and edited with GPT-6 Astra. Reviewed by Chris at Black Swamp AI.

← All articles