An AI agent for small business can take over five everyday operations today: sorting and answering the routine inbox, turning enquiries into quotes and quotes into invoices, chasing unpaid invoices on a schedule, keeping stock above reorder points and drafting the purchase orders, and running the diary and the follow-ups that fall out of it. Each of these is routine, reviewable, and made of steps a system can expose as actions.
The condition is the software. An agent cannot do any of these against a system it can only read, or one where the inbox, the invoices and the stock live in three places that do not know about each other. What you are choosing, when you choose to hand a job to an agent, is a system that exposes that job's actions as tools the agent can call under your permissions. Pick one job, prove it, then add the next.
Monday, twenty to nine, a firm of nine
The owner of a nine-person installation business opens the laptop. Forty-one new emails. Three are enquiries that need a quote by the end of the day, two are customers asking where their invoice is, one is a supplier saying a delivery has slipped, one is a fitter asking for Friday off, four are confirmations that need an entry in the diary, and the rest is noise. Two invoices from August are unpaid and nobody has chased them. The stockroom is low on a fitting that is on every job this week, and the reorder is in someone's head.
None of this is hard. All of it is the owner's morning, and it will be the owner's morning again tomorrow. The reason it stays with the owner is not that it needs judgement; it is that the work lives in four systems and the only thing that connects them is a person. That is the situation an agent changes, provided the systems are built so that an agent can act in them.
Five operations an agent can take over today
These are the five that come up in nearly every small firm, in the order most owners feel them. For each, the middle column is what the agent does and the right column is the condition the software underneath has to meet. The right column is the part most articles leave out, and it is the part that decides whether the job can actually be handed over.
| Operation | What the agent does | What the software must provide |
|---|---|---|
| The inbox | Sorts new mail by what it is, answers the routine questions from the record, files the rest against the right customer or supplier, and lists what needs you | Mail in the same system as the customer records, so a reply can be written from the order, the invoice or the delivery date rather than from guesswork |
| Quoting and invoicing | Drafts a quote from the enquiry and your price list, sends it when you approve, converts it to an invoice when the job is done, sends the invoice with the document attached | Quotes, invoices and contacts as actions, not just screens: create, send, convert, with the tax treatment and the customer's reference carried through |
| Chasing | Runs a written reminder schedule each morning on the balance outstanding, sends statements, pauses when a customer replies or promises a date, hands you the exceptions | The balance due per invoice, the accounts contact on the customer, replies landing against the invoice, and pauses stored as data |
| Stock and reorders | Watches stock against reorder points, drafts purchase orders to the usual supplier, asks before spending above your limit, records receipts when goods arrive | Stock levels and reorder points on the record, supplier and price on the item, purchase orders as an action with an approval threshold |
| The diary and follow-ups | Books confirmed jobs into the calendar, creates the follow-up task when a quote goes quiet or a job completes, sends the reminder the day before | Calendar, tasks and contacts in one place, so the follow-up is linked to the quote it came from |
Every row has the same shape: a routine the agent runs, and a structural requirement on the system. Where the requirement is not met, the agent can still talk about the job; it cannot do it.
There is a sixth that owners expect and should be cautious about: money to a new payee, pricing outside the list, or a promise the firm has not made before. An agent can prepare all three. Approving them is where the owner's authority sits, and the system should make the agent stop and ask.
What every one of them needs from the software underneath
Look at the right-hand column again and the five requirements collapse into four properties of the system. They are worth stating plainly, because they are what to test any product against before you believe the word agent on its home page.
- Actions, not just screens. Sending an invoice, creating a purchase order and booking a job have to exist as defined operations an agent can call, with inputs and a result. If the only way to send an invoice is to click a button, the agent is a spectator.
- One record. The inbox has to know about the invoices, the invoices about the contacts, the stock about the suppliers. Four systems connected by a person are four systems the agent has to reconcile before it can act, and the reconciliation is where the mistakes come from.
- Your permissions, not the agent's. The agent should act as you, or as the colleague it is working for, and never more. If a fitter cannot approve a purchase order, the fitter's agent cannot either. This is what makes it safe to give a nine-person firm nine agents.
- A log you can read. Every action the agent took, with what it was given and what happened, so that reviewing a week of the agent's work is the same task as reviewing a week of a colleague's.
The open protocol that makes this practical is the Model Context Protocol, which lets a business system publish its actions as tools that any compatible agent (Claude, ChatGPT, a coding agent, an internal one) can discover and call. Its specification asks servers to enforce access controls and validate inputs, and asks clients to keep a person able to see and deny tool calls. For a small firm the practical consequence is that you do not have to buy the vendor's assistant; you connect the agent you already pay for.
One morning, run through
Here is the Monday above, handed to an agent connected to a Sois workspace where the inbox, contacts, quotes, invoices, stock and calendar are one record. The owner's request is the sort of thing you would say to a capable office manager on the way in.
- Reading forty-one new messages and matching each to a customer, supplier or job
- Replies sent for the two invoice-status questions, from the invoice record
- Three quotes drafted from the enquiries and the price list, held for your approval
- Reminders sent for the two August invoices with a statement attached
- Four confirmed jobs booked into the calendar with a reminder the day before
- Exceptions gathered: the slipped delivery, the Friday leave request, one enquiry outside the price list
The agent used the inbox, contact, quote, invoice, calendar and task tools the owner's role allows. It sent nothing that commits the firm to a price, and it stopped on the three things a person should see.
Two features of the run deserve a second look. The quotes were drafted and held, because a price is a commitment and the owner had not delegated it. And the three exceptions are real ones: a supplier problem affecting this week's jobs, a staffing decision, and a request the firm has never priced. The owner's morning is now three approvals and three decisions, and the record of everything else exists as if they had done it themselves.
How to choose the first job
Do not start with the inbox, even though it hurts most. The inbox is the widest job, touches every other record, and is the hardest to review. Start with the job that is narrowest, most routine, most reviewable, and cheapest to get wrong. For most small firms that is chasing: a short written policy, a small number of invoices, messages you can read before they go, and an obvious measure of success in the money that arrives. Quoting from a fixed price list is a close second. Stock reorders are a good third once you trust the agent with a spending limit.
Run the chosen job by hand for a week first, writing down what you did and why. That page is the policy you hand to the agent. Then let the agent run it with you reviewing every action for a week, then reviewing the exceptions only. Widen to the next job when the first one has been boring for a month. Boring is the goal; an agent whose work you have to check closely is not saving you the time you hoped.
Cost and control for a small firm
The cost question is simpler than it looks. If you already pay for Claude, ChatGPT or another agent, the reasoning is paid for; what you need from a business system is that it lets that agent in and charges for the workspace and what it stores, not for AI it did not perform. If you have no agent, you need a system whose own agent takes a plain-language message and acts, with a cap on what that can cost so a runaway task cannot surprise you.
Sois is one system built on this model. The workspace is an MCP server; you add its address to the agent you already use and sign in once over OAuth, with no token to paste. The agent sees only the tools your role allows, every call is checked again when it runs, access fails closed, and every action is logged against you. When your own agent does the reasoning, Sois performs no AI on your behalf and charges nothing for it; the Sois agent runs on credit with a spend limit per integration. Whichever system you choose, the test is the same: connect your own agent from outside, hand it one of the five jobs, and see whether it completes it end to end within your permissions with nobody at the screen.
Questions people ask
Which job should a small business hand to an AI agent first?
The narrowest, most routine and most reviewable one. For most firms that is invoice chasing: a one-page policy, messages you can read before they go, and a measure of success in cash received. Quoting from a fixed price list is a close second.
Do I need to buy a specific AI assistant to do this?
No. If your business system speaks the Model Context Protocol, the agent you already use (Claude, ChatGPT, Cursor or another MCP client) connects to it and acts within your permissions. If you have no agent, some systems provide their own that takes a plain-language message.
Is it safe to let an agent send email and invoices for my business?
It is safe to the extent the system enforces it: the agent acts as a named person with that person's permissions, sends only through tools it is allowed, stops and asks on anything that commits the firm, and logs every action. Review the log weekly at first, then monthly.
What does it cost a small business?
A workspace plan and usage, plus agent consumption only when the system's own agent does the reasoning. When your own agent does the reasoning, a system built this way performs no AI on your behalf and should charge nothing for it.
- Model Context Protocol specification: tools how a business system publishes actions as tools, and the security responsibilities of servers and clients
- Sois: connect your agent the three-step connection, supported clients, OAuth sign-in, spend limits per integration
- Sois: pricing plan, usage and agent credit; no AI charge when your own agent does the reasoning
This article is reviewed when the products it describes change. Next scheduled review: 4 December 2026.