Short answer: An AI agent is a language model that can use tools: it reads from your systems, decides the next step and acts. In a small business it is safe for reading, sorting, drafting and preparing work. A person should approve anything that spends money, goes to a customer, deletes data or decides something about a person.
"AI agent" is one of those terms that got popular before it got a definition. Depending on who is selling, it means a chatbot, a workflow with a language model somewhere in the middle, or a digital employee that will run your back office while you sleep. The first two exist. The third is a sales deck.
For a small business the useful questions are plainer. What is this thing, what can I give it to do without worrying, and where do I still need a person to say yes?
What is an AI agent?
A chatbot answers. An agent does things. That is the whole difference, and it matters more than it sounds.
An agent is a language model connected to tools: your inbox, your CRM, a spreadsheet, your order system. You give it a goal, such as "sort today's support emails and draft replies to the simple ones". It reads what it needs, picks a step, uses a tool, looks at the result and picks the next step. Nobody scripts each move in advance, which is what separates it from ordinary automation, where every step is fixed.
That freedom is the point, and it is also the risk. A fixed workflow can only do what you wrote. An agent can do anything its tools allow, including things you didn't have in mind.
What can an AI agent safely do in a small business?
The safe jobs have something in common: if the agent gets it wrong, somebody notices before it costs anything.
- Reading and sorting. Tagging incoming emails, routing enquiries to the right person, pulling order numbers and dates out of messy messages.
- Drafting. Replies to common questions, a first version of a quote, a summary of a long thread. A person reads the draft and sends it, or doesn't.
- Looking things up. "Where is this order?" "What did we agree with this customer in March?" The agent searches your own systems and answers with a link to where it found the answer.
- Preparing work. Filling in the invoice, the refund form or the CRM record and leaving it ready for someone to check and confirm.
- Checking. Comparing a supplier invoice with the purchase order and flagging the ones that don't match.
None of these lets the agent do something that can't be undone. It reads, it suggests, it prepares. If it misreads an email, the worst outcome is a bad draft that somebody deletes.
Where must a human approve?
The line sits wherever a mistake is expensive or permanent.
- Money leaving the business. Payments, refunds, discounts, purchase orders. The agent can prepare them. A person presses the button.
- Anything sent to a customer in your name. Especially prices, promises, contract terms and replies to complaints.
- Deleting or overwriting data. Closing accounts, merging records, bulk edits. An agent that can delete will eventually delete the wrong thing.
- Decisions about people. Hiring, credit, access to a service. These carry legal weight and somebody has to be able to explain them later.
- Changing access. Passwords, permissions, new user accounts.
This isn't caution for its own sake. OWASP, the security body that keeps a list of the main risks in applications built on language models, has an entry called "excessive agency". It names three causes: the agent has tools it doesn't need, the tools have more permissions than the job requires, and the agent can take high-impact actions with nobody checking. The fixes it lists are the unglamorous ones: give the agent only the tools it needs, give those tools the minimum access (read-only where possible), and require a person to approve high-impact actions.
What stops an agent doing something it shouldn't?
Not the instructions you give it. Telling a model "never issue refunds over 100" is a request, not a control. Language models can be confused by odd input, and they can be manipulated by text they read along the way, such as an email that says "ignore your previous instructions".
The real limits live outside the model:
- Permissions. If the agent's account cannot delete customers, it cannot delete customers, whatever it decides.
- Approval steps. Risky actions go into a queue and wait for a person.
- Logs. Every action is recorded with what the agent read and why it acted, so a mistake can be traced.
- Tests. A set of real cases with known good answers, run again every time something changes.
- An off switch. One person who knows how to stop it, and what the team does by hand while it's off.
OWASP makes the same point: the downstream system should enforce what is allowed, instead of trusting the model to decide. Logging won't prevent a bad action, but it limits the damage and tells you what happened.
Do customers need to know they're talking to an AI?
In the EU, yes. The European Commission's summary of the AI Act says that when people use chatbots, they should be made aware that they are interacting with a machine. Most small-business uses of AI otherwise fall into what the Act treats as minimal risk, with no specific rules. Uses that affect people's lives, such as sorting CVs or scoring credit, are classed as high risk and come with strict obligations, including human oversight.
That is a summary and not legal advice. If an agent will talk to your customers or have a say in decisions about people, check the rules for your case before it goes live.
How to start with one
- Pick one task. Boring, frequent and easy to check. Sorting the support inbox is a better first job than "handle customer service".
- Write down what a good result looks like. Twenty real examples with the answer you'd want. If you can't agree on the right answer, the agent can't either.
- Start read-only. Let it read and draft for a few weeks while people do the sending.
- Look at what it gets wrong. Fix the instructions, the tools or the scope. Add the failures to the test cases.
- Widen slowly. Let it act on its own only where the errors have been cheap and rare, and keep the approval step everywhere else.
NIST's AI Risk Management Framework, a voluntary guide from the US standards body, is longer and more formal reading on the same idea: work out what could go wrong for the people affected before you rely on the system.
When is an agent the wrong tool?
If the task follows the same steps every time, you don't need an agent. A plain automation is cheaper, faster and does the same thing on Tuesday as it did on Monday. Agents earn their place where the input is messy and each case needs a bit of reading before anyone knows what to do with it.
Sources
- OWASP Gen AI Security Project, LLM06:2025 Excessive Agency, on the causes of agents doing damage and how to limit them.
- European Commission, AI Act: regulatory framework for AI, on risk levels and telling people when they are interacting with a machine.
- NIST, AI Risk Management Framework, a voluntary framework for managing the risks of AI systems.
If you have a task in mind and want to know whether an agent fits it, the AI agents page explains how we build them: connected to the tools you already use, with permissions, logs, tests and a person approving anything risky. Or book a free call and describe the task. We reply within 24 hours.