The Agentic SME: Running Operations With AI Agents

Most small businesses already use AI to write things. Far fewer let it do things. That second step, from a chatbot that drafts an email to an agent that reads the inbox, checks the order system and sends the reply, is where the operational gains are. It is also where the risk sits, because an agent that can act can act wrongly.

This guide is for owners and operators of lean teams who want to put agents to work on real operations without betting the business on them. It covers what an agent is, where small firms actually stand, which jobs to hand over first, and the guardrails that matter.

What an AI agent is, and what it is not

The cleanest distinction comes from Anthropic’s engineering guidance. Workflows are systems where models and tools follow predefined code paths. Agents are systems where the model directs its own process and tool use, deciding how to get the job done (Anthropic, 2024). The same guide advises finding the simplest solution possible and adding complexity only when needed, and notes that agentic systems often trade latency and cost for better task performance.

Gartner draws a similar line for business use: use agents when decisions are needed, automation for routine workflows, and assistants for simple retrieval (Gartner, June 2025). That is a useful filter for a small team. If the job is “when an invoice arrives, copy these three fields into the accounting tool”, you want a rule, not an agent. If the job is “work out which of these forty supplier emails need a reply today, and draft them”, judgment is involved, and an agent earns its cost.

In practice an agent has three parts:

• A model. which reads the situation and decides the next step.
• Tools. the connections it can use to look things up or take action, such as your inbox, calendar, accounting software or order system.
• Instructions. the written brief and limits that define the job and when to stop.

OpenAI’s practical guide uses the same breakdown of model, tools and instructions (OpenAI). The tools are where the business value sits, and where most of the risk is.

Where small businesses actually are

Adoption of AI in general is now mainstream for small firms. The US Chamber of Commerce’s 2026 survey of 3,732 US small businesses found that 66% use AI, up from 23% in 2023. Agents are newer: 24% reported using an agentic AI tool, and 34% named agentic AI as a technology they plan to adopt (US Chamber of Commerce, 2026).

Deeper use is rarer. The OECD’s 2026 survey of just over 2,000 SMEs across 12 countries found that 61% used at least one AI application, but 76% of those users were “AI novices” relying on simple, off-the-shelf tools for isolated tasks. Only 3.6% deployed agentic AI, and only 21% saw significant or transformational impact from AI (OECD, 2026). The OECD itself notes its sample is not representative and skews towards digitally active firms, so the real share is likely lower still.

Read together, the message is plain. Most small firms are experimenting with chat tools. Very few have wired AI into how work actually flows. A small team that gets one or two agents running reliably in operations is ahead of the market, not behind it.

What a shop-running AI teaches about autonomy

The most instructive public test of an agent running a small business is Anthropic’s Project Vend. For about a month in 2025, a Claude model ran a small office shop with web search, email, a notes tool, a customer chat channel and control over prices (Anthropic, June 2025).

It did some things well. It found suppliers for niche products, launched a pre-order service when customers asked for one, and refused attempts to get it to stock harmful items. It also turned down a $100 offer for a drink that cost about $15, priced some items below cost, gave customers a payment account it had invented, and kept handing out discount codes after saying it would stop. Anthropic’s verdict was that it would not hire it.

The lesson for an operator is not that agents are useless. Anthropic attributes many of the failures to missing structure: weak instructions and no proper business tools such as a customer record system. The lesson is that open-ended autonomy over money and pricing is the hardest possible job to hand over. The jobs to start with are the opposite: bounded, repetitive and checkable.

Where to start: the operations worth handing over

Score each candidate job against four questions. The best first jobs answer yes to all four.

1. Frequent. a task done daily or weekly gives the agent enough repetitions to prove itself, and you enough examples to judge it.
2. Messy inputs, clear goal. emails, PDFs and free-text requests where a rule breaks, but where “done” is obvious.
3. Cheap, visible mistakes. a wrong draft caught before sending costs a minute. A wrong payment costs a lot more.
4. Safe to start read-only. the job can run on read access or drafts at first. If it only works with full write access from day one, it is not a first job.

Operations that usually pass this test in a small business:

• Inbox triage. sort incoming mail by type and urgency, flag what needs the owner, and draft replies to routine questions.
• Order-status and returns intake. look up the order, draft the customer reply, and open a return for a person to confirm.
• Invoice and receipt matching. read supplier invoices, match them to purchase orders, and flag mismatches for review rather than paying them.
• Supplier and customer follow-ups. chase overdue confirmations or missing documents with drafts a person sends or approves in bulk.
• Scheduling. propose meeting or delivery slots from calendars and constraints, with a person confirming.
• Weekly operating report. pull figures from the tools you already use and write a first-draft summary of what changed.

If you are still deciding whether a job needs an agent at all, or an off-the-shelf tool would do, run it through our build, buy or agent test first.

What not to hand over first: pricing, refunds, payments and open-ended negotiation. These come last, if at all.

Read, draft, act: give autonomy in steps

The most useful decision you make is not which agent product to buy. It is how much the agent is allowed to do on its own. Treat it as a ladder, and move up only when the record justifies it.

1. Read. the agent can look things up and summarize, but changes nothing. This is where you learn whether it understands the job.
2. Draft. the agent prepares the reply, the entry or the update, and a person approves it with one click. Track how often drafts go out unchanged.
3. Act within limits. the agent completes low-risk actions on its own inside hard limits, such as replies to order-status questions, while anything outside those limits still goes to a person.

A practical promotion rule: move a task up one rung only after a few weeks in which the large majority of drafts were approved without edits and none of the edits were serious. Set your own threshold, write it down, and apply it to every task so promotions are evidence-based rather than enthusiasm-based.

The guardrails that keep it safe

OWASP, the open security community that publishes the standard risk list for AI applications, names the core danger “excessive agency”: an AI system taking damaging actions because it has too much functionality, too many permissions or too much autonomy (OWASP). Those three causes map directly to the guardrails a small team should put in place.

• Fewest tools. connect only the systems the job needs. An inbox agent does not need access to your bank or your file drive.
• Narrowest permissions. give each connection the minimum rights, ideally read-only to begin with, and enforce limits in the underlying system rather than trusting the agent to respect them.

Human approval for money and anything irreversible. OpenAI’s guide recommends rating each tool by risk, considering whether it is read-only or write, whether the action can be reversed, and its financial impact, and keeping a person in the loop for high-risk actions such as canceling orders, authorizing large refunds or making payments (OpenAI).

Assume content can carry instructions. Prompt injection is when text the agent reads changes its behavior in unintended ways, and the indirect form arrives through outside content such as websites or files (OWASP). For an agent reading customer emails and supplier PDFs, this is the main way outsiders can try to steer it. OWASP says it is unclear whether any method fully prevents it, which is exactly why limited permissions and human approval matter more than clever instructions.

Stopping conditions and a log. Anthropic recommends sandboxed testing, checkpoints where the agent pauses for human feedback, and stopping conditions such as a maximum number of steps (Anthropic). Add a log of every action the agent takes and one named person who can switch it off.

These controls slot into a broader one-page AI policy. If you do not have one yet, start with our guide to AI governance for small teams.

A 60-day rollout for a lean team

1. Weeks 1 to 2: pick and map one job. choose a single operation that passes the four-question test, write down how it is done today, and record a baseline: volume, time spent and error rate.
2. Weeks 3 to 4: run in read mode. connect only the tools the job needs, read-only. Have the agent summarize and classify, and compare its output with what your team would have done.
3. Weeks 5 to 6: move to drafts. let it prepare replies or entries for approval. Track the approve-unchanged rate and the kinds of edits people make, and fix the instructions accordingly.
4. Weeks 7 to 8: act within limits, or stop. if the record supports it, allow the lowest-risk actions on their own. If it does not, keep it in draft mode or drop the job. Both are valid outcomes.

Stopping is not failure. Gartner predicts that over 40% of agentic AI projects will be canceled by the end of 2027, citing escalating costs, unclear business value or inadequate risk controls, and estimates that only about 130 of the thousands of vendors claiming agentic AI are the real thing (Gartner, June 2025). A small team that measures from day one finds out cheaply which side of that line it is on.

How to know it is working

• Hours returned. time your team no longer spends on the job, measured against the baseline, not estimated.
• Approve-unchanged rate. the share of drafts accepted without edits. It is the best single signal of readiness for more autonomy.
• Error and escalation rate. how often the agent gets it wrong or hands back to a person, and whether that is falling.
• Response time. for customer-facing jobs, how quickly people now get an answer.
• Total cost. subscription, usage and the human review time, compared with what the job cost before.

The mistakes that sink agent projects

• Starting with money. pricing, refunds and payments are the hardest jobs to delegate, not the first.
• Granting broad access to save setup time. one shared admin login across every tool is the fastest route to an incident.
• Using an agent where a rule would do. if the steps never change, a plain automation is cheaper, faster and more predictable.
• Skipping the baseline. without before-and-after numbers you cannot tell a useful agent from an expensive one.
• Promoting on enthusiasm. more autonomy should follow a written threshold, not a good week.

The agentic SME is not a business run by software. It is a lean team that has handed its most repetitive operational work to agents, kept the judgment calls and the money with people, and widened the agents’ remit only as fast as the evidence allows. Done that way, a five-person company can take real operational load off its people in targeted workflows, with the risk kept in proportion.

If you want help choosing the first job to hand over and setting it up safely, that is the kind of work we do at Gaveau Strategy.