11 things I let an AI agent do in my business, and 4 I don't
I delegate work that is reversible and keep the actions that are public, financial, or hard to undo. An agent can research, draft, build, and organize. I still press Send, publish the final version, approve money changes, and control permissions. The cost of a mistake decides who gets the last step.
Key takeaways
- •Sort by reversibility, not importance. If I cannot undo it in half a minute, I do it myself.
- •Anything a stranger will see gets a human on the last step.
- •Agents earn their keep on the boring middle of a job that crosses six screens.
- •Money and permissions are not a policy I wrote. Those operations are missing from what the agent can call, which is sturdier.
- •The audit trail matters more than the capability list. Read what changed, not what it says changed.
The rule I sort by
I did not reason my way to this list. I handed over too much, then walked it back.
The question that survived is one I ask before every delegation: can I undo this in thirty seconds? Deleting a contact is a soft delete, so yes. A page keeps a hundred revisions, so yes. Merging two duplicates rewrites the survivor and there is no unmerge, so no. A sent email is gone.
The second question is who sees the mistake. A wrong draft costs me an afternoon. A wrong published page costs me an afternoon plus however many strangers read it first.
Between them those two sort almost everything. Reversible and private goes to the agent; irreversible or public stays with me. The eleven below sit in the first box, the four after them do not.
The eleven I hand over
Every one of these is something I have asked for in English, in a chat window. Where the mechanism matters I have named it, and where one caught me out I have said so.
1. Draft a landing page
This is the one that converted me. I describe the offer and a site, a page and its lead form appear in the account. The write defaults to a draft, so nothing changes for visitors, and back comes a preview link that renders the unpublished version. Publishing is a separate call, and I make it.
2. Build a course skeleton from an outline
Hand it a table of contents and back come lessons, a graded test with its answer key, an assignment and a certificate. The editor has no one-click course generator, so this is the only route. One honest limit: theory written this way renders to students, but the visual editor will not show it and overwrites it on the next manual save.
3. Segment the contact base
A saved segment is a stringified predicate with seventy-four condition types behind it, sixty-one of them usable in a broadcast. Writing one by hand is the least pleasant ten minutes of my week. The catch: it is stored as sent and never validated, so a wrong condition returns a cheerful success over zero rows.
4. Build an automation graph
To be precise about who does what: the automation engine is the platform's and would run these graphs whether an agent existed or not. The agent draws one, and can dry-run each node before writing it. The trap it saves me from is wiring two nodes with the wrong link type, so the branch never fires and nothing reports it.
5. Write a broadcast to a saved segment
Write, not send. Letter, template, sender profile and audience come back assembled. This one lives closest to the line, because a broadcast has no draft state and creating one arms it. What makes it survivable is that it arrives dated a day out, and moving that date to now is a sentence I type.
“Tell me how many people finished module three, save that as a segment, and build Thursday's email to it. Do not send it.”
The count comes first on purpose.
6. Import contacts
It reads the spreadsheet with its own tools, maps the columns, runs a dry pass and shows me the report before anything lands. Email or phone is the identity, so a match updates rather than duplicates. When it meets a custom field the account does not have, it stops and asks. That is most of why I trust it.
7. Tag and reassign in bulk
Tagging two hundred people, moving a batch to a new owner, adding a group without wiping the ones already there. Dull, fiddly, precisely what I get wrong at five in the afternoon. The rule I say out loud every time: scope the filter. An empty filter means every contact in the account.
8. Set up a booking page
Slug, durations, hosts, availability windows, the guest form. Two surprises. The page publishes itself on creation, a real exception to my own rule, so I give it a name nobody would search for. And the video-call link needs a calendar account connected through a browser sign-in an agent cannot complete, so the page books and quietly has no link.
9. Upload and configure video
A video that already lives at a URL goes in, gets a cover frame, a domain allowlist and an embed. Two limits worth knowing first. A YouTube link is not an upload, it is an iframe, and nothing enters the account. And a file on my laptop still needs me, because a chat client cannot push the bytes.
10. Build a form or a quiz
From a starter template, then fields one at a time out of twenty-three types. This one also publishes on creation and generates its embed straight away, which I did not expect. Answers become filter conditions afterwards, the real argument for building forms where the contacts live.
11. Pull the weekly numbers
Counts, raw sessions, raw page views, the history timeline, what the in-product AI spent this month. Not a dashboard, a question: how many contacts came from the webinar page last week, and how many bought? The joins no built-in report offers are the point, and reading is the safest thing it does.
If you would rather see the mechanics than the list, the page on an AI agent that runs your business walks one job end to end.
The four I don't
These are the ones people ask about, so here is the reasoning rather than the rule. Two are my policy. Two are not policy at all.
Press send
The agent can write the email, build the audience, and schedule it. I still send it. A bad draft is easy to fix; a bad email reaches the whole list and cannot be recalled. While a send is running, it can be paused and then aborted. Once it finishes, the mistake is permanent.
Publish anything a stranger will see
Same logic, softer stakes. A page keeps a hundred revisions, so publishing is not truly irreversible. What is irreversible is the person who read the wrong price in the ninety seconds it was live. The last look is not quality control, because I am no better a proofreader than the model. It is the moment I take responsibility.
Touch money
Billing writes are not available to the agent. It cannot change the balance, saved card, auto-recharge, spending cap, or billing terms. That boundary lives in the tool surface, not in a prompt.
Recording a payment against an order is available, but I keep that action too. Money should not move because an instruction was misunderstood.
Hand out keys
Creating an admin, changing what an admin may do, minting an API token, inviting or removing a colleague: all gone for one reason. An agent that can edit a role can add every right to the role it already holds, and after that the question of what it may do has no stable answer. It runs as whoever signed in, so connect it as a limited admin and that is the whole of its reach.
The full inventory, and the reason each entry is on it, is in the agent guardrails reference.
Three habits that made the difference
None of them are settings.
Make it say what it is about to change, before it changes it. Not a ceremony, a real instruction: tell me what you are going to create, and wait. Most of my near misses died in that reply, with a filter scoped to the wrong thing where I could read it.
Ask for the count before the write. Segments and bulk actions fail silently, so a condition the platform cannot parse is ignored and you get a success over the wrong rows. A count costs nothing and it is the only thing that catches this.
Ask for the link, then open it. Every write comes back as a link into the admin, and bulk work leaves a row in the history timeline. I open two or three at random. That minute separates trusting a summary from trusting an account.
A confirmation flag is a speed bump, not a lock. Bulk deletions ask for one, but the caller sets it on itself, so treat it as a habit your side keeps rather than a guarantee.
What a week looks like
Monday it pulls the numbers and I read them with coffee. Tuesday, if something is launching, it builds the page and the product and sends a preview link; I publish or I don't. Wednesday it drafts the broadcast and schedules it forward, and I send it Thursday morning after reading it once.
Not a revolution. Roughly a day a week I no longer spend in browser tabs, and a shorter list of things I forget.
FAQ
Do I need to be technical to do any of this?
No, and that surprised me more than anything else. Connecting the assistant is a URL and a browser sign-in. Everything above is typed in plain English into a window you already have open. The learned skill is knowing when to be suspicious.
What happens when it gets something wrong?
Usually very little, because most of what it touches is a draft or a soft delete. Every change lands in the history timeline and a page keeps its last hundred revisions. The failures that hurt are the silent ones: a filter that matched nobody, a node link that never fires.
Is a removed operation really different from telling the model not to?
Yes, and it is the one distinction I would insist on. A prompt competes with every other instruction in a long conversation. A removed operation is not an instruction at all, because there is nothing to call. When a vendor sells you agent safety, ask which of the two you are being sold.
Does this replace the automations I already run?
No. An automation is deterministic: same trigger, same steps, every time. An agent is for work that varies, like setup, analysis or a migration. I use the agent to build the automation, which then runs perfectly well without it.
Will this list be different in a year?
The eleven will get longer. I doubt the four will move. They are not claims about what a model can do, they are claims about which mistakes are expensive, and that does not change when the model improves.
Start with the read-only jobs.
Connect the assistant you already use and ask it to count something. Publishing and sending stay separate, deliberate steps.