Agents that help run a business

Small businesses drown in work that is too fiddly for software and too boring for people: chasing the invoice that’s three weeks late, sorting the shared inbox, replying “your order shipped yesterday” for the fortieth time. That’s where agents earn their keep. It’s also where they can do real damage, because these jobs touch customers and money.

The skill this lesson teaches is deciding, action by action, what the agent may do on its own.

Three levels of trust

For every action an agent could take, pick one:

• Alone. Reading, sorting, drafting, making internal notes. If it gets one wrong, someone notices and fixes it, and nobody outside is affected.
• Ask a person. Anything that reaches a customer, moves money or can’t be undone. The agent prepares it - the email written, the fee calculated - and a person clicks send.
• Never. Actions where even an approved mistake would be too costly, or where a person should do the whole job anyway.

OWASP’s name for getting this wrong is excessive agency. It lists three root causes, “excessive functionality”, “excessive permissions” and “excessive autonomy”, and the fix for the last is to “require a human to approve high-impact actions before they are taken”. Its example is a mail assistant whose extension “also contains functions for sending messages” when it only needed to read. One injected email, and the agent forwards your customers’ data to an attacker.

1. 1The everyday reading, sorting and drafting run alone. That is most of the work, and a mistake there is caught before it leaves the building.
2. 2Anything a customer will see, or that moves money, waits for one click from a person. The agent did the work; a person owns the decision.
3. 3Some actions stay with people entirely. And a small refund can run alone - if the cap is enforced in the payment code, not just written in the prompt.

Design one

Pick a job, set each action, choose how many tasks a month and which model, and check the design. Two checks grade it: risk (nothing that reaches outside, moves uncapped money or can’t be undone runs alone) and useful (the everyday work runs alone, and the job itself isn’t switched off). An agent that asks permission for everything isn’t safe. It’s just slow.

What it costs

The model bill is tokens times price. On 2026-10-30, Anthropic’s list prices per million tokens were:

Model	Input	Output
Claude Haiku 5.5 (prompts up to 100,000 tokens)	$0.10	$0.50
Claude Sonnet 5.5	$2	$10
Claude Opus 5.5	$4	$20

Prices change, so check the pricing page before you budget. Repeated context can be cached: the same page lists cache reads on Opus 5.5 and Sonnet 5.5 at 0.05 times the input price, which matters for agents because every turn re-reads the conversation.

In the widget, chasing 200 invoices a month on Sonnet 5.5 comes to about $8 in model costs, under a dollar on Haiku 5.5 and about $16 on Opus 5.5. That’s using an illustrative profile of four turns per invoice. Compare it with the other number on screen: 240 approvals, about four hours of someone’s month. For a small business, the expensive part of an agent is rarely the model. It’s the attention it needs - which is why getting the “alone” list right matters more than the model choice.

Before you switch it on

• Shadow it first. Let the agent draft for a few weeks while people keep doing the job, and compare. The drafts that were wrong become your eval set.
• Give it its own narrow accounts. A read-only login to the invoicing system, a mailbox that can only draft. OWASP’s mail example recommends exactly that: a read-only extension and a read-only access scope.
• Know where the data goes. Customer emails sent to a hosted model leave your building. Read the provider’s data terms, or run a local model for the sensitive jobs.
• Log every action. When a customer asks “why did I get this email?”, you need the answer.

Do it for real · your machine+50 XP bonus

Everything above ran in your browser. Now try it in a real terminal: any Linux machine, a Mac's Terminal app, or Windows with WSL. Nothing to install beyond that.

Build a small agent for one of these jobs on your own machine, with fake data first. Two neutral starting points:

• A hosted model. Anthropic’s tutorial: build a tool-using agent goes from one tool call to a full loop. Current model IDs include claude-haiku-5-5, claude-sonnet-5-5 and claude-opus-5-5. Other providers’ tool-calling APIs follow the same shape.
• A local model. Ollama supports tool calling with models such as Llama 3.1 and Mistral Nemo, passing tool definitions in the chat request’s tools field. Nothing leaves your machine, which suits customer data.

Whichever you pick: give it read tools first, make every “send” tool write a draft file instead of sending, put a step limit in the loop, and log every call. Run it on ten fake invoices and read the log before it ever sees a real one.

I tried it on my machineSelf-reported. We can't see your machine, and we don't want to. This is a bonus, never required.