Question 1

How do you give an AI agent your own logic as a tool in n8n?

Accepted Answer

Show the mechanism, then add the quality details — the details are the difference. "I build the logic as its own sub-workflow: it starts with an Execute Sub-workflow Trigger, I declare the expected input fields, then do the work with ordinary nodes and return a result. On the agent side I attach a Call n8n Workflow Tool sub-node pointing at that workflow. Two details are decisive. First, the description. The agent picks tools by description — it is documentation written for the agent. It should say three things: what the tool returns, when to use it, and what happens when nothing is found. "CRM tool" tells it nothing. Second, the parameters. Rather than setting them in advance I delegate them with $fromAI() — $fromAI('email', 'the customer email address', 'string'), for instance. The model finds the value in context, and in a chat it can ask the user when it cannot. The advantage of this approach is that the logic stays testable: I can run the sub-workflow on its own, independently of the agent."

Question 2

The AI agent picks the wrong tool, or calls none at all. How do you diagnose it?

Accepted Answer

Give a sequence and highlight the most common cause. "1. I look at the tool descriptions. Most causes are there. If two descriptions are similar the model cannot tell them apart. I make them concrete: what it returns, when to use it, and when not to. 2. I reduce the number of tools. Handing over ten tools and asking "why does it choose wrong?" is pointless. I remove the ones it does not need — fewer tools, fewer mistakes. 3. I look at the system prompt. The agent's role and boundaries are set there. An explicit instruction like "always use the orders tool for questions about orders" often solves it outright. 4. I read the execution history. An agent runs several times per execution and every step shows up — which tool it called, what came back, what it did next. That is the most valuable diagnostic source. 5. I look at what the tool returns. Sometimes the right tool was picked but it returns too much or irrelevant data and the model cannot read it properly. The result needs trimming. If I still cannot find the cause, I reconsider whether the task really needs an agent — a fixed sequence is often both cheaper and more consistent."

Question 3

What are the risks of letting an AI agent perform real operations?

Accepted Answer

List the risks, then give a concrete control for each. "Risk 1 — the wrong tool at the wrong moment. The model can misread the situation and invoke "cancel the order". Control: put a human approval in front of irreversible tools. n8n documents this pattern — the agent requires approval before executing specific tools. Risk 2 — prompt injection. The data an agent reads — emails, web pages, documents — can contain text that looks like instructions. Control: treat everything the agent sees as untrusted, limit its action tools, and keep sensitive ones behind approval. Risk 3 — excessive permission. The permissions on the credential you give the agent are the boundary of what it can do. Control: least privilege — no write access where reading is enough. Risk 4 — loops and cost. The agent calls a tool, dislikes the result and calls again. Control: execution limits and cost monitoring. Risk 5 — silent errors. The agent produces a convincing but wrong result. Control: semantic validation of the output, and measuring quality with n8n's evaluation features. My governing principle: I give an agent read access freely, and write access only behind approval."

Tool	What for	Practical note
Call n8n Workflow Tool	Giving the agent your own business logic	The most powerful one — built as a sub-workflow with declared input fields
HTTP Request Tool	Any API or website	As a tool it can optimise the response — less data reaches the model
Custom Code Tool	Calculations, conversions	`$fromAI()` does not work in this tool
Vector Store (as a tool)	Semantic search over your own documents	The description matters — it is how the agent knows when to reach for it
MCP Client	Tools from external MCP servers	Registry servers can be connected in one click with OAuth2

The AI Agent and its tools

📚 Sources and documentation