- What an agent actually does when it take actions on your behalf
- What context is, and how it shapes what you build
- Ways to structure your project so your agent picks up where it left off, every session
- How to keep your credentials safe when building on HubSpot
- A few guiding principles for building thoughtfully with AI
Agents and LLMs
An is the AI model itself. It’s the part that understands your prompts and generates text. An agent is that same LLM paired with a harness: software that runs the LLM in a loop and gives it tools to take actions in the world, like reading files, running terminal commands, or calling APIs. This is the key difference between an agent and a plain chat interface: a plain LLM only produces text in response to your prompts. An agent can act on its own: it can observe a situation, take an action, process the result, and keep going until the task is done. The harness is what enables this. It intercepts the LLM’s responses, detects when the model wants to use a tool, executes it, and feeds the result back. Harnesses can also add capabilities beyond the LLM itself (like persistent memory across sessions), and because the harness and LLM are separate components, most harnesses support swapping between different LLM models.The harness is what connects the LLM to all of the capabilities (system prompt, memory, tools) that make it an agent.
The context window
The AI context window is the maximum amount of data (measured in tokens) that an LLM can process as input at any single time. Think of it as the agent’s short-term memory. Every time you send a new message and the LLM generates a response, every time the agent reads a document, looks at an image, or opens a code file, it consumes more of that context window. When an agent comes close to filling its context window, it has to make room to keep working. Different tools handle this differently: some summarize earlier parts of the conversation (Claude Code calls this compaction), others silently drop older messages, and some stop with an error. In most cases, something is lost in the process, which can result in the agent producing worse output. Check your tool’s documentation for how it handles a full context window. To keep your agent’s context clean:- Start fresh sessions for each new feature you’re working on. A long conversation where you’re asking the agent to add many features and configure many things at once can result in the context window getting bloated and the agent losing finer details that degrade the quality of its output.
- If your agent supports it, you can also clear the agent’s context manually instead of spinning up a new agent or chat. Aside from clearing between new feature development, this can also be particularly helpful when an agent gets stuck in logic loops or continuously hits dead ends and failed attempts. If you’re using Claude Code, you can run
/clearto reset the context without starting a new session.
Types of context
For an agent to produce the highest quality results, it should have three important pieces of context:Business context
Systems context
Platform context
Your agent instructions file
Most AI coding agents support a file that lives in your project and gives the agent standing instructions, such as how you like to work, what conventions to follow, and what context it should always have. Every new session reads this file automatically, so you don’t need to re-explain your preferences each time.hs project create or hs get-started commands, HubSpot automatically includes its own set of agent context files when you create a new local project. These give agents an informed starting point before writing any code.
Spec-driven development
Spec-driven development is a way of structuring your project that helps each agent session start informed. The idea is to maintain markdown files in your project that describe what you’re building and how it works, including the goals, the features, the data model, and the user experience. These files become the source of truth for the project, something the agent reads at the start of each session rather than piecing together from the code itself.
This is particularly useful for multi-session projects. Each new agent session starts with an empty context window and no memory of previous work. Spec files give the agent a high-level picture of the project from the start, so it can pick up where the last session left off without needing you to re-explain everything.
- Documentation of a code project is typically the last thing to get updated, and people working on the project end up with institutional knowledge that never gets communicated out. This problem is worse if the code was AI-generated, because it’s possible the human that generated it doesn’t fully understand it. Spec-driven development reduces the extent of this problem by ensuring there’s a human-readable explanation of what the software does.
- When iterating on a project, instead of loading the full codebase into the agent’s context window you can load the spec documents instead, giving it a high-level understanding of how the application is built. The agent can then discover the pieces of the codebase one by one until it finds the files it needs to work on.
- The agent can make assumptions about how something is implemented in another part of the codebase based on the specs.
- The codebase and the specification documents can become out of sync, which can confuse both humans and AI.
- The agent sometimes ends up needing to load the full codebase anyway, which can mean wasted tokens.
Secrets and security
Secrets are authentication credentials such as API keys and access tokens, that grant the ability to act on your behalf for various functions like retrieving, updating, or deleting data. Secrets should never be shared or exposed because it risks compromising your account on whichever platform the secret gives access to. When you type into a coding agent’s chat interface, that input is sent to the LLM provider’s servers. Pasting a secret into your prompt, instructions file, or any project file the agent reads sends that value to those servers as well. To safely provide authentication credentials when building on HubSpot, you can use the HubSpot CLI secret manager to store them securely:process.env.SECRET_NAME), not the value itself.
For private app access tokens specifically, HubSpot provides PRIVATE_APP_ACCESS_TOKEN automatically in every serverless function with no setup required. This means you never need to copy your app’s access token out of HubSpot and paste it anywhere.
For the full set of CLI commands, see managing secrets.