Start from a template. The three of them cover the most frequent cases and already come with input, agent, and output connected.
An agent without Sources or Tools for simple tasks. Each Source and each tool adds latency and cost, so do not turn them on in a step that only classifies or summarizes.
Human Review on everything that has an external effect (sending a message, writing to a system) until a couple of weeks of traces give you confidence.
Protect the webhook with a token and the Authorization header from day one.
Check Costo acumulado (Accumulated cost) every week in workflows with WhatsApp or a webhook: they are the ones that receive volume without anyone triggering them by hand.
Publish small versions. Large changes make it hard to know what broke a run.
