Our Lisbon AI agent development follows a methodology designed for European compliance and Portuguese market reality: (1) Agent design and goal definition (weeks 1-2): defining what the agent does and doesn't do. Goal specification: precisely defining the agent's objectives, scope, and boundaries. Not "build a customer service agent" but "build an agent that handles Portuguese-language customer inquiries about order status, returns (compliant with DL 24/2014), and product information — escalating complaints, complex returns, and any interaction involving personal data disputes to human agents." Boundary definition: what the agent explicitly cannot do. In regulated environments: agents must have hard boundaries — a financial agent that can prepare credit analyses but cannot approve loans, a legal agent that can draft document summaries but cannot provide legal advice, a healthcare agent that can schedule appointments but cannot offer medical guidance. These boundaries: defined in the architecture, not just the prompt. Tool inventory: defining what tools the agent can use — APIs (which endpoints, with what authentication), databases (read-only vs. read-write access), external services (search, email, calendar), and code execution (what languages, what libraries, with what resource limits). Each tool: documented with its purpose, inputs, outputs, and failure modes. EU AI Act risk classification: assessing the agent's risk level under the EU AI Act. Most business agents fall under limited risk (transparency obligations) or minimal risk (no specific requirements). Agents in healthcare, employment, finance, or law enforcement may be high risk — requiring conformity assessments, technical documentation, and human oversight mechanisms. The classification: determining the compliance obligations built into the agent's architecture. (2) Agent architecture (weeks 2-3): designing how the agent reasons and acts. Reasoning framework: selecting the agent's cognitive architecture. ReAct (Reasoning + Acting — the agent alternating between thinking about the problem and taking actions. Good for tasks requiring step-by-step problem-solving), Plan-and-Execute (the agent creating a complete plan before executing — reviewing and adjusting after each step. Better for complex, multi-step tasks where the overall approach matters), or Custom orchestration (for specific workflows where the task structure is well-defined — the agent following a defined process with decision points rather than reasoning from scratch each time. More predictable, more auditable, but less flexible). Model selection: choosing the LLM backbone. Considerations for Lisbon: Portuguese language capability (GPT-4 and Claude handle European Portuguese reasonably well; smaller models may struggle with PT-specific vocabulary and grammar), EU data processing (if using cloud-based models — data processing agreements required under RGPD; models hosted in the EU preferred for sensitive data), latency requirements (real-time agents — customer-facing — needing fast inference; batch-processing agents tolerating higher latency for better accuracy), and cost (agent operations involve multiple LLM calls per task — model cost directly affecting operating economics). Memory architecture: how the agent maintains context. Short-term (conversation context — the current task and its steps), working memory (intermediate results, tool outputs, and reasoning steps — maintained during task execution), and long-term (learned patterns, user preferences, and historical outcomes — persisted between sessions for continuous improvement). For RGPD compliance: memory containing personal data must be managed carefully — retention limits, access controls, and deletion capability. (3) Development and tool integration (weeks 3-6): building the agent and connecting it to business systems. Agent development: implementing the reasoning framework with the selected model, tools, and memory architecture. Development stack: LangChain or LangGraph (agent frameworks providing structured tool use, memory management, and orchestration), Python (the lingua franca of AI development — FastAPI for the agent's API interface), and containerised deployment (Docker — for consistent development, testing, and production environments). Portuguese-specific development: Portuguese language testing (agent responses evaluated by native European Portuguese speakers — catching Brazilian Portuguese vocabulary, incorrect verb forms, and unnatural phrasing), Portuguese business system integration (connecting to Portuguese platforms — AT eFatura, Portal das Finanças, Segurança Social Direta, SIBS/Multibanco for payment processing), and Portuguese date and number formats (dd/mm/yyyy dates, comma decimal separators, euro currency formatting — the agent producing output in Portuguese conventions). Tool development: building the agent's tool interfaces. Each tool: a clean API wrapper with input validation, output parsing, error handling, and logging. Tools for Portuguese business context: AT integration (querying tax status, submitting declarations), SIBS/Multibanco (payment reference generation, payment status checking), CTT tracking (Portuguese postal service shipment tracking), and Portuguese company registry (Registo Comercial queries for business information). Safety mechanisms: guardrails preventing the agent from: exceeding its defined scope (attempting actions outside its tool set), generating harmful content (racist, discriminatory, or inappropriate responses — particularly important for customer-facing agents), making unauthorised decisions (spending money, approving applications, or committing to contracts without human authorisation), and processing excessive personal data (accessing more personal data than necessary for the immediate task). (4) Testing and validation (weeks 5-7): ensuring the agent works reliably. Functional testing: testing every agent capability — standard scenarios, edge cases, and failure modes. Portuguese-specific testing: Portuguese language accuracy (grammar, vocabulary, formality level — European Portuguese, not Brazilian), Portuguese regulatory compliance (agent responses and actions compliant with Portuguese law), Portuguese business scenarios (realistic test cases based on Portuguese business practices — payment terms, tax calculations, legal requirements), and multilingual scenarios (agent switching between Portuguese and English within a single interaction — common in Lisbon's international business environment). Adversarial testing: deliberately trying to break the agent — prompt injection (manipulating the agent into ignoring its instructions), goal hijacking (redirecting the agent to serve a different purpose), information extraction (tricking the agent into revealing confidential data or system information), and boundary violations (persuading the agent to exceed its defined scope). Reliability testing: running the agent through hundreds of realistic scenarios — measuring: task completion rate (does the agent successfully complete the assigned task?), accuracy (are the agent's outputs correct?), appropriate escalation (does the agent correctly identify when to hand off to a human?), and recovery (when the agent encounters an error, does it recover gracefully or fail silently?). Performance testing: measuring latency, cost per task, and throughput under realistic load conditions. (5) Deployment and monitoring (weeks 6-8): going live with confidence. Deployment: containerised deployment on EU infrastructure (AWS eu-west-1 Ireland or eu-south-2 Spain). Monitoring: comprehensive observability — task metrics (completion rate, accuracy, latency, cost per task), error tracking (failed tasks categorised by failure type — tool failures, reasoning errors, boundary violations), user feedback (satisfaction ratings, correction frequency, escalation triggers), drift detection (monitoring for degradation in agent performance — model updates, data distribution changes, or evolving business rules causing performance decline), and compliance monitoring (RGPD data access logging, EU AI Act transparency compliance, and boundary adherence). Continuous improvement: agent performance improving over time — failed tasks analysed and addressed (tool improvements, prompt refinements, new edge case handling), user feedback incorporated (adjusting agent behaviour based on how users interact with it), and model updates evaluated (when underlying LLMs are updated — testing the agent against the benchmark suite before updating production).