How to build an AI agent for your business: a practical SMB guide with Claude, n8n and Supabase

The question I hear most often from founders and IT leads at Italian and European SMBs in 2026 is always the same, phrased slightly differently: how do we build an AI agent for our company that actually does something useful, rather than answering two FAQs? It is a fair question. In eighteen months the vocabulary has shifted: we used to talk about chatbots, now we talk about agents. But the difference is not terminological, it is architectural. A chatbot answers a message. An agent observes a context, decides what to do, executes concrete actions on your systems (CRM, ERP, calendar, email, database) and reports the result. This guide is designed to take you from your first use case to a production deploy, with the same stack I use in real client projects: Claude as the brain, n8n as the nervous system, Supabase as persistent memory.

Before opening an editor or creating an account, the foundational step is choosing the use case. This is where most business AI agent projects fail: teams pick an objective that is too generic ("an agent that runs customer care") or too ambitious ("an agent that replaces the sales rep"). The approach that works is the opposite: start from a specific, repetitive, measurable, high-volume process. Two examples I have seen work in companies with fewer than fifty employees are inbound lead qualification and first-level customer support ticket handling. In the first case, the agent receives a lead from a form, the website or WhatsApp, asks three to five qualification questions following BANT or a similar method, updates the CRM with score and notes and either assigns the lead to the right sales rep or discards it with a reason. In the second case, the agent reads the ticket, consults the internal knowledge base, drafts a reply for the customer and, if the request falls into a predefined list, resolves it autonomously by updating an order, issuing a return or changing an appointment. Both cases share three key elements: structured input, defined actions, a clear success criterion. Those are the minimum conditions for an agent to make sense.

The second step is choosing the language model, the brain of the agent. In 2026 the pragmatic choice for the European market is Anthropic's Claude, for three concrete reasons. The first is reasoning quality across European languages: Claude Sonnet 5 and Claude Opus 4.8 handle formal Italian, French, German and Spanish, along with B2B language nuances, with an accuracy competing models only partially match. The second is availability of Model Context Protocol (MCP), the open standard that lets the agent connect to your business tools (Google Workspace, Slack, databases, CRMs) through a single protocol instead of writing custom integrations for every service. The third is predictable pricing: for lead qualification at an SMB receiving between one hundred and five hundred contacts per month, Claude's monthly cost typically lands between twenty and one hundred euros, figures compatible with any business budget. Alternatives like GPT-5.5 or self-hosted open source models on your own GPUs (GLM 5.2, Kimi K2.7) are valid in specific scenarios (strict privacy, very high volumes, fine-tuning needs), but for a first business agent Claude significantly reduces time to value.

The third step is orchestration, that is, choosing how the agent receives inputs, executes actions and produces outputs. Here my recommendation for an SMB is n8n, the open source workflow automation platform that in 2026 has become the de facto standard for non-enterprise business agents. The reasons are practical: n8n self-installs in thirty minutes on a small server (a five-euro-per-month VPS is enough, or Docker on your existing office server), it already ships connectors for over four hundred services (Gmail, Outlook, HubSpot, Salesforce, Shopify, WooCommerce, WhatsApp Business, Telegram and the main databases), it natively integrates AI model APIs through an official Claude node, it lets you visualize flows as diagrams anyone can read even without coding skills and it keeps all code and data on your servers. Alternatives like Make.com or Zapier have a gentler learning curve but become expensive quickly as volumes grow and do not allow self-hosting, which for many European SMBs is an implicit or explicit compliance requirement.

The fourth step is memory, the system that lets the agent remember previous conversations, customer data and the results of past actions. For this component the pragmatic choice is Supabase, the open source platform based on PostgreSQL that bundles a relational database, vector search (needed for the agent's semantic knowledge base), authentication, file storage and an auto-generated REST API. Concretely: you will create a table for conversations, one for customers, one for embeddings of your internal knowledge base (manuals, FAQs, price lists, procedures) and one for a structured log of the agent's actions. Supabase's advantage over closed SaaS solutions is twofold: cost is marginal below five hundred active users (the free tier is enough for most pilot projects) and portability is total, because under the hood it is standard PostgreSQL and you can migrate your data elsewhere at any time.

With these three pieces (Claude, n8n, Supabase) the typical architecture of your first agent takes a clean shape. The trigger is an event in a business system: a new form submission on the website, a WhatsApp message, an email in a dedicated inbox, a ticket opened on the support portal. n8n receives the event, prepares the context by querying Supabase to pull the customer's history and relevant knowledge base documents through vector search, and hands everything to Claude with a system prompt that spells out role, tone, allowed actions and human escalation criteria. Claude reasons over the context and decides whether to answer directly, call one of the available tools (update the CRM, create a calendar event, send an internal notification, open a ticket for a technician) or ask for human intervention. n8n executes the decided actions, writes everything to the Supabase log and closes the loop by notifying the outcome to the user and internal teams. The full flow, for a simple use case like lead qualification, can concretely be built in one to two working days by a developer experienced with this stack.

The fifth step, the one that separates a toy prototype from a production-ready agent, is guardrail design. An agent in production must have clear, non-negotiable boundaries: what it can do autonomously, what requires human approval, what it must never do under any circumstance. In practice this translates into three tiers. Tier one, safe low-reversibility actions: reply to the customer with knowledge base information, add CRM notes, send internal notifications. The agent runs these without asking permission. Tier two, actions with operational impact: modify an order, issue a refund below a threshold, book an appointment in a colleague's calendar. Here the agent prepares the proposal but requires human confirmation or applies automatic limits (refunds only below fifty euros, appointments only in slots already marked as available). Tier three, forbidden actions: delete data, close accounts, send unsolicited commercial communications, promise unauthorized discounts. These must be blocked in the system prompt and verified through explicit validation in the n8n workflow before execution. The cost of a mistake across these three tiers is very different, and the agent must treat them differently.

The sixth step is the controlled pilot phase, which typically lasts two to four weeks. During the pilot the agent works in shadow mode or supervised mode: every response and every action is reviewed by a human operator before being actually sent to the customer or written to systems. This unlocks two fundamental things. First, calibrating the system prompt and the knowledge base: in the early days you will discover cases you had not anticipated, phrasings that confuse the agent and gaps in internal documentation. Every correction should be tracked in Supabase and reused to improve the system. Second, measuring the business metrics that justify the investment: percentage of leads qualified correctly, average customer response time, autonomous ticket resolution rate, human hours saved compared to the manual process. Without these metrics the agent remains a technological toy. With these metrics it becomes a business asset with demonstrable ROI, and the conversation with leadership changes completely.

The seventh step, often overlooked, is regulatory compliance in the Italian and European context. An AI agent that handles customer or employee data falls under GDPR and, from August 2, 2026, under the operational provisions of the European AI Act for high-risk systems. Three concrete actions to take from day one of development: explicitly inform the customer that they are interacting with an AI system (transparency obligation under Article 50 of the AI Act), ensure that personal data processed by the agent stays on EU infrastructure (Supabase offers an EU region, self-hosted n8n solves this at the root, Claude via Anthropic is available with EU data residency on the Enterprise plan) and keep a detailed log of every automated decision the agent makes for at least six months (the structured Supabase log mentioned earlier is exactly for this). Ignoring these aspects during prototyping means having to re-engineer them later, when it is far more expensive and risky.

The eighth and final step is the production deploy with continuous monitoring. n8n has to move from local execution or a development VPS to a production environment with automatic backups of the Postgres database and workflows, error alerting via email or Slack and a documented rollback plan in case of malfunctions. Supabase in production requires enabling row-level security policies on every table the agent can access, so that even in case of prompt injection the model cannot exfiltrate data it has no business touching. On the model side, Claude should be monitored for two operational metrics: refusal rate (the times it refuses a legitimate action out of excessive caution) and hallucination rate (the times it invents information not present in the context). Both metrics are measured by human sampling on five to ten percent of conversations and improved by iterating on the system prompt and the knowledge base. From this point on, the agent's lifecycle is similar to any other critical software system: regular releases, versioning of configurations, periodic API cost review, upgrading the Claude model when new versions with meaningful improvements ship.

If you have read this far, you have a complete picture of how a business AI agent for a European SMB is concretely built in 2026. The question worth asking now is no longer theoretical: which specific, repetitive, measurable process costs you the most time every week and could be the ideal candidate for your first pilot? If you have a clear answer and need a technical partner to build the prototype, test it against your real data and bring it to production with the security and compliance guarantees your business requires, the contact page on this site is the starting point. The competitive advantage in 2026 for European SMBs is not having the most powerful AI, it is being the first in your industry to integrate it into daily processes in a useful, controlled and measurable way.