7. How do you build the first agent without building the whole speech stack?

Use a test number and sandbox tools before touching the public line. The following platform example illustrates the mechanics; it is not a supplier recommendation.

A concrete dashboard-led starting path

Vapi’s current telephone quickstart documents this sequence:

1. Create an account and open Assistants.
2. Start from a suitable template.
3. Edit the first message and system instructions.
4. Publish the assistant version.
5. Test a web conversation.
6. Create or import a telephone number and assign the assistant.
7. Call it from an actual telephone and inspect the call logs.

Its free Vapi numbers support inbound calling; outbound calling requires an imported number under the documented setup. Keep outbound disabled unless separately approved. (docs.vapi.ai)

For the pilot, make these additional buyer-controlled choices:

• Put billing and administrative accounts under the business, not a contractor’s personal account.
• Separate development and production credentials.
• Start with read-only functions where possible.
• Set maximum call duration, usage alerts and a spending-review trigger.
• Define supported languages and the fallback for unsupported requests.
• Store the published version, prompt, knowledge revision and tool schema together.
• Remove any template capability you have not approved.

Vapi documents built-in and custom tools and specifically cautions that caller-influenced values must be validated at the destination before sensitive actions. Use that as a minimum integration requirement, not an optional improvement. (docs.vapi.ai)

What should your initial prompt specify?

Use this original structure rather than a long marketing persona:

Identity: automated assistant for the named business.
Scope: the explicitly approved tasks and locations.
Information: use only approved policies and current tool results.
Questions: collect only the minimum required fields.
Actions: use the permitted tools; never invent a successful result.
Confirmation: confirm a booking only after verified backend success.
Uncertainty: explain what is not confirmed and use the recovery path.
Escalation: honour the approved human-request and exception rules.
Privacy: do not disclose protected account details before verification.
Closing: distinguish confirmed booking, pending request and callback.

Keep authorisation and transaction constraints in the backend. Do not expect this prompt alone to enforce them.

What if you genuinely need a code-first build?

LiveKit’s quickstart supports Python and Node.js, offers starter projects and distinguishes cloud deployment from self-hosting. Its documented architecture supports both STT–LLM–TTS pipelines and realtime speech models. (docs.livekit.io)

For that route, assign explicit owners to:

1. Audio session handling and interruption behaviour.
2. Model and speech-provider configuration.
3. Telephony connectivity and routing.
4. Application tools and transaction state.
5. Deployment, secrets and scaling.
6. Evaluation, monitoring and incident response.

Do not approve self-hosting solely on an assumed saving per minute. Compare the engineering and operating work required under each design.