Agentic Coding for Business Automation Glue
Opening answer (BLUF)
Use agentic coding on internal glue when the ticket is small, the contract is written down, and a person still owns the merge. A coding agent such as Claude Code is built to gather context, edit files, run commands, and check its own work in a loop, which is the right shape for FastAPI adapters, field transforms, and n8n custom nodes.[1] It is the wrong shape for production credentials, open-ended shell access, or any write that can move money or wipe records without a human gate. Visual n8n nodes and the HTTP Request node still win when the job is a documented REST call. Custom code wins when the workflow needs a real transform, a GraphQL client, or a policy check that a canvas cannot express.
Glue work is a mapper, not a product
Most automation backlog is not a new product. It is a mapper. A CRM field name does not match the billing API. A webhook payload needs a checksum. A warehouse export needs a typed model so junk rows fail closed. That is glue: small Python services, TypeScript nodes, and adapters between systems you already run.
FastAPI is a good default for that layer. A few path operations give you an HTTP surface and an OpenAPI schema that other tools can call without a briefing document that goes stale.[5] n8n is a good default for the orchestration around it. Built-in nodes and the HTTP Request node cover a large share of REST work, including auth reuse from credentials you already stored.[3][12]
The decision is not "AI versus humans." It is which layer writes which file. We treat coding agents as junior implementers on a branch, and operators as the people who define the contract, hold the secrets, and approve the merge. NIST asks for documented roles in human-AI configurations and for human oversight processes that match those policies.[2] Its generative AI profile then asks organizations to govern, map, measure, and manage extra risks that come from how people use the model, not only from the weights.[11]
Ops teams in Charlotte, NC, hit this split every week, as do operators we work with in Raleigh, NC, Asheville, NC, and Philadelphia, PA. A visual workflow often covers the happy path. One nested transform is what blocks the rest.
Visual n8n first, then HTTP, then custom code
Start on the canvas. If a native node already covers the verb, use it. If the native node is missing one operation but the vendor still has a REST endpoint, n8n's own guidance is to make a custom API call with the HTTP Request node and reuse a predefined credential type rather than inventing a new integration.[3][12] That is the cheapest glue: visible, and secrets stay in n8n credentials.
Write a custom node only after that path fails. n8n documents two building styles. Declarative style is the default for REST: JSON-based routing, less code. Programmatic style, with an `execute()` method, is required for trigger nodes, GraphQL, external npm dependencies, and any node that must transform incoming data.[4][13] Pagination, nested line items, and "if status is X then rewrite Y" rules are transforms. They belong in code with tests.
Use this ladder: native node, then HTTP Request with an existing credential (including credential-only integrations), then a declarative custom node for a REST surface you will call often, then a programmatic node or a FastAPI service when you need a transform or a policy check the canvas cannot own.[12] Do not skip to the last step because a coding agent is available.
When a coding agent should write the adapter
Claude Code is an agentic harness: models reason, tools act. Built-in tools cover file edits, search, shell and test execution, and fetching docs. The loop is gather context, take action, verify results, then repeat.[1] That loop only helps when you can name the verify step in the ticket.
A good ticket names the fixture, the error cases, and the test file. Example: add a FastAPI POST `/webhooks/orders` that accepts a JSON fixture, rejects unknown SKUs with 422, and writes a normalized record. Tests live in `tests/test_orders_webhook.py` and must pass. Another: map vendor payload A to invoice schema B in an n8n programmatic node, covering empty arrays and duplicate `external_id` values, with no delete or update verbs.
Anthropic's own workflow examples show the agent running a test suite, reading the error, editing source, and running tests again.[1] If you cannot state the verify phase, you do not yet have an agent ticket. You have a design conversation.
Permission mode is part of the ticket. Claude Code's Manual mode (config value `default`) asks before file edits and shell commands. Plan mode lets the agent explore without editing source. `dontAsk` is for CI with an explicit allowlist, such as `Bash(npm test)` plus `Read`. `bypassPermissions` is documented for isolated containers and VMs only.[6] For glue work we start in Plan, then Manual or Accept edits on a feature branch. We do not hand the agent production deploy credentials.
OWASP's 2025 list names the failure mode: Excessive Agency, when an LLM-based system is given more functionality, permissions, or autonomy than the job needs, so a bad or injected output can still take a damaging action.[8] Mitigations match glue work: minimize tools, avoid open-ended shell, require human approval for high-impact actions, and enforce authorization downstream rather than asking the model if an action is allowed.[8]
Let the agent write the adapter only when schemas are in the repo, production secrets are out of context, tests are part of the change, the work lives on a branch, and a named reviewer will read the diff before merge. If any item is missing, fill the gap first.
When a person should still type the path
People should still type the parts that encode trust. Credential loading and token refresh belong in the environment or a secret manager, not in a prompt and not in a committed file. FastAPI can declare standard security schemes (API keys, HTTP bearer, OAuth2 flows), but declaring a scheme is not the same as embedding a live key.[14] Authorization policy is a human document: who may call the service, which tenant rows, which verbs. So are deletes, refunds, production schema changes, and any call that posts to a live customer channel. If two operators disagree on "cancelled versus voided," the agent will pick one and make it look official.
OWASP separates two risks teams often mash together. Improper Output Handling is about trusting model output before it hits a shell, a database, or another API. Listed failures include `exec`/`eval`, unsanitized SQL, path traversal, and code-generation workflows that introduce injection bugs or hallucinated packages.[7] Excessive Agency is about what the agent is allowed to do even when output handling is sloppy.[8] A FastAPI handler that runs LLM-written SQL is an output-handling bug. An n8n custom node with a generic "run command" helper is an agency bug.
NIST wants oversight roles defined and human oversight processes written down, not implied by whoever ran the agent that afternoon.[2] For generative systems it also notes that many risks start in human behavior, including misuse and unsafe repurposing, which is a reminder that the merge button is a control.[11] If the blast radius is "retry the job," an agent can draft it. If the blast radius is "page legal," a person types it.
Review, tests, and secrets hygiene
Do not merge agent output because it compiled. Treat it as untrusted input. OWASP's prevention list for improper output handling starts with a zero-trust stance toward model responses, parameterized queries, context-aware encoding, and logging when outputs go sideways.[7] For code, that means tests on the transform and a reviewer who looks for authz gaps, not just style.
The security record on AI-written code is a reason to keep those tests, not a reason to freeze the tools. A 2025 analysis of 7,703 public GitHub files attributed to AI coding tools found 4,241 CWE instances across 77 types. The same study reported that 87.9% of those files did not contain identifiable CWE-mapped vulnerabilities, while Python (the language most glue is written in) showed higher vulnerability rates, from 16.18% to 18.50% depending on the tool.[9] Most snippets are clean enough to ship after a pass. Python glue is the bucket that needs the pass.
Do not paste production API keys into the agent thread, and do not let the agent read a local env file that is gitignored but still on disk. Point it at dummy values and inject real secrets at runtime. GitHub secret scanning exists because hardcoded credentials in git history, issues, and pull requests are a standard failure mode. Public repositories are scanned automatically, and the remediation advice is to rotate the credential first.[10] If an agent commit trips a scanner, treat it as an incident.
Before merge, confirm the diff stays on ticket paths, tests cover the named unhappy paths, no new host or write verb appeared, and no secrets landed in logs or fixtures. An n8n node should follow the documented style for its job: declarative for REST, programmatic only when a transform or trigger requires it.[4] FastAPI error bodies should not leak internals.[5] Plan mode first, then a narrow edit, then CI, then a human. If the first ticket is an HTTP Request node, do not force a custom node. If it is a nested transform, do not force the canvas.
We keep the same bar for clients who already run AI business tools alongside internal automation: scoped tools and a person on the high-impact path.
Practical takeaways
- Put visual n8n and the HTTP Request node first. Add a custom node or FastAPI service only when you need a transform, GraphQL, or a policy check the canvas cannot own.[3][4][12]
- Write agent tickets with fixtures, error cases, and a named test file. If you cannot name the verify step, do not start the agent.[1]
- Start Claude Code in Plan mode, then Manual or Accept edits on a branch. Reserve `dontAsk` for CI allowlists. Keep bypass permissions inside isolated environments.[6]
- Keep production credentials out of the agent context. Rotate anything that lands in git.[10]
- Review agent diffs for extra verbs and extra hosts. OWASP's excessive-agency and improper-output-handling entries are the threat model for glue.[7][8]
- Expect Python glue to need a closer look than "it ran." In the 2025 GitHub corpus, Python AI-attributed files had CWE rates from 16.18% to 18.50%.[9]
- Assign a human owner for merge and rollback. NIST wants those human-AI roles in writing.[2][11]
How we can help
We design the internal automation layer: n8n workflows, FastAPI adapters, and the review path that keeps a coding agent inside the ticket. If you want a scoped glue build rather than another unbounded chat window, start with a single stuck integration.
Have more questions or want to get in touch? Visit https://ideaforgestudios.com/contact-us-idea-forge-studios/, call (980) 322-4500, or email [email protected].
Citations
- Anthropic Claude Code Docs, "How Claude Code works" (2026)
- NIST AIRC, "AI RMF Core" (2023, excerpt of NIST AI RMF 1.0)
- n8n Docs, "HTTP Request" (2026)
- n8n Docs, "Choose a node building style" (2026)
- FastAPI, "First Steps" (2026)
- Anthropic Claude Code Docs, "Choose a permission mode" (2026)
- OWASP GenAI, "LLM05:2025 Improper Output Handling" (2025)
- OWASP GenAI, "LLM06:2025 Excessive Agency" (2025)
- Schreiber and Tippe, arXiv:2510.26103, "Security Vulnerabilities in AI-Generated Code: A Large-Scale Analysis of Public GitHub Repositories" (2025-10-30)
- GitHub Docs, "Secret scanning" (2026)
- NIST, "NIST AI 600-1: Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile" (2024-07)
- n8n Docs, "Custom API actions for existing nodes" (2026)
- n8n Docs, "Overview" (creating nodes) (2026)
- FastAPI, "Security" (2026)
