What this protects
What you let an agent do on your behalf
An agent with permission to act inside your systems can also make a mistake at scale. The access you grant matters more than how clever the tool sounds.
Money and records
An agent that can raise an invoice or change a supplier acts with your authority. Grant that access deliberately.
Client data
What the tool reads and sends to a third party is a data protection question as much as a technical one.
Audit trail
If you cannot say what it did and on whose authority, you cannot investigate the day it gets something wrong.
The difference between answering and acting
A chatbot sits in a window and produces text. That is genuinely useful for drafting, summarising and explaining, and most businesses have now worked that out.
An agent is different. It has access to your systems and the ability to do things inside them: send the email, update the record, raise the ticket, move the file. The moment software can act, the question changes from \"is the output good?\" to \"what happens when it is wrong?\"
That difference matters more than any feature list, because an unhelpful answer costs you a minute and a wrong action costs you a customer.
What this looks like in a business your size
You do not need a research team to see the shape of it. The same tools that summarise a document are being extended to act on what they find: triaging an inbox, drafting and sending routine replies, matching an invoice against a purchase order, filling in a form on a supplier portal.
The practical appeal is that these are the jobs nobody enjoys and the ones that eat the afternoon. The practical risk is that they touch money, customers and records, usually without anyone watching closely.
The questions that matter before you switch anything on
What can it reach?
An agent with read access to a shared drive is a tool. One with permission to pay suppliers is a colleague you did not interview.
Where does a human still approve?
Anything irreversible or financial should have a person in the loop until you have real evidence it behaves.
What is the audit trail?
You need to know what it did, when, and on whose authority. If that is a mystery, you cannot investigate a mistake.
Whose account does it use?
An agent acting as a named employee inherits that person's access, and their blame, unless you separate it deliberately.
How would you know it failed?
Silent failure is the default. Decide what good looks like and how you would spot it drifting.
What data does it learn from?
Be clear about what is sent to a third party, and what your clients would think if you told them.
Guardrails worth putting in first
- Give the agent its own identity rather than borrowing a person's, so you can switch it off cleanly
- Start with read-only access, then widen it deliberately rather than by default
- Keep a human approval step on anything that moves money or contacts clients
- Log every action somewhere you can actually search
- Agree with your team what the agent is for, so it does not quietly become responsible for everything
- Set a date to review whether it is still worth the access you gave it
Where it is genuinely useful now
The strongest cases are repetitive, well-defined and low-stakes on their own: routing enquiries, summarising long threads, drafting first replies, tidying data that never quite matched between two systems.
That is unglamorous work. It is also where the hours go, and where a mistake is usually noticed and corrected by the next person in the chain.
Where it is not ready in your business
- Anything with a legal or regulatory decision attached, where you need a name against the judgement
- Payments and supplier changes, which fraudsters specifically design attacks around
- Custody of personal data you would struggle to explain to a client
- Anywhere you cannot easily reverse the action once it has happened
What to do about it
- Decide what the agent can reach before anyone switches it on.
- Give it its own identity and start with read-only access.
- Keep a human in the loop on money, clients and anything irreversible.
- Log what it does, and set a date to review the access you granted.
Questions we get asked about this
Is agentic AI just a chatbot with a better name?
No. A chatbot produces text for you to act on. An agent acts inside your systems on your behalf, which is why the access you give it matters more than how clever it sounds.
Do we need to do anything yet, or can we wait?
You can wait on adopting it. You cannot wait on knowing what has already been switched on, because AI features increasingly arrive as defaults in tools you already use.
What is the biggest mistake small businesses make here?
Granting access because it was the quickest way to make the tool work, then never reviewing it. The same mistake people make with leavers, and with the same consequences.