AI Agents That Ask Before They Act: What a Small Business Should (and Shouldn't) Let Them Do

A supplier emails on a busy Tuesday: new bank details, please pay the attached invoice today. An AI agent connected to your inbox and your business account could read that email, match the invoice and send the money before you have finished your coffee. Whether that is useful or dangerous depends entirely on one design choice: does the agent prepare the payment and ask you, or does it simply pay?

The short answer for a small business: let an agent read, sort, summarise, draft and prepare, because that is where it saves time and mistakes are cheap to catch. Make it stop and wait for a person before anything leaves the business or cannot be undone, which means payments, messages to customers, deleting data, signing and changes to bank or payroll details. Decide everything in between with a few plain questions about reversibility, money, personal data and how quickly you can check the work.

Why this matters this week

Three announcements in three days, and a Gusto showcase the day after, put agent-style tools in front of small businesses. They do not draw the same line.

• Google, 20 October. In its announcement of new Gemini tools for small business owners, Google introduced a business landing page in the Gemini app, connections to Google Business Profile, Google Ads and Google Workspace, and apps such as Shopify, Xero, Canva and Dropbox. Gemini can turn spreadsheets, receipts and purchase records into financial graphics and interactive models. Google says these tools are beginning to roll out globally to all Gemini app users over the coming days. The post does not say which actions Gemini can take inside the connected apps.
• Anthropic, 21 October. Claude Duet is a research preview of a proactive agent aimed at professionals and small business owners. It reads, drafts and prepares work on its own, but Anthropic says that before it sends a message, makes a payment, signs a document or deletes anything, it shows exactly what it is about to do and waits for approval. Some actions, such as trading securities or moving money between accounts, are off-limits even with approval. For now it is US-only, via a waitlist, for Pro and Max subscribers.
• Stripe, 21 October. Stripe Treasury for agents lets agents, including ChatGPT and Claude, check balances, pay invoices, transfer funds between accounts and convert currencies. Stripe says businesses will be able to set spending limits for their agents "in the coming weeks". Its developer documentation says that by default you review and approve any agent action that results in live money movement, and the Treasury tools are in public preview. Treasury itself is listed as public preview in the United States and the United Kingdom. Australia is private preview. EU countries are not on the list.
• Gusto, 22 October. At its Fall Showcase, Gusto said owners can connect Gusto to Claude, ChatGPT and other AI tools to ask questions, prepare payroll and generate reports, and that they approve every change before it is final. The connection itself is older: Gusto announced its ChatGPT app on 20 January 2026 and Claude and Slack on 8 April 2026. Gusto is built for US employers: the same showcase covers state tax registration, multi-state payroll and 401(k) plans. Gusto's help article says running payroll this way is still limited to some customers during early access.

Notice that the vendors do not draw the line in the same place. Claude Duet will not move money between accounts even if you approve it. Stripe's agent tools can move money between accounts. By default you approve any live money movement, and the business chooses when that approval is required. That is a good reason to set your own policy instead of inheriting whichever default a product ships with.

Prepare versus act: the line that matters

An AI agent is software that can plan steps and use tools, such as your email, calendar, accounts or payroll system, to reach a goal you give it. A connector is the link that lets it reach one of those tools.

Preparing means the agent does the work up to the point of commitment: it reads the invoice, checks it against the purchase order, fills in the payment and puts it in front of you. Acting means the commitment itself: the money leaves, the email arrives in a customer's inbox, the record is gone. In the tools above, the time saved is in the preparation, and the loss sits in the final step.

Gusto's help article puts the risk bluntly. Connected AI platforms can both read data and take action in your Gusto account, and you are responsible for reviewing actions before they run. Gusto strongly recommends not enabling settings that let tools run automatically without your approval.

Why agents need an approval step

An approval step answers three problems that a smarter model does not remove.

Plain mistakes. Anthropic says of its own agent that it "still might misread a thread or miscalibrate what's urgent". A misread thread is harmless in a draft and expensive in a sent email or a paid invoice.

Instructions hidden in what the agent reads. An agent reads emails, invoices and web pages written by other people, and any of them can contain text meant to steer it. This is called prompt injection. The UK's National Cyber Security Centre explains in its blog post "Prompt injection is not SQL injection" that current language models do not enforce a boundary between instructions and data, and that such attacks may never be totally mitigated. It cites a simple rule: an AI processing emails from outside people should not have access to privileged tools. Anthropic's Claude Duet help page makes the same point about its own product: no defence is perfect, "which is one reason consequential actions need your approval".

Speed. In its guidance on adopting agentic AI carefully, the NCSC warns that problems are harder to spot when actions happen faster than people can meaningfully review them. It also says humans remain accountable for the decision to deploy an agent, the access it was given and the consequences.

Risk tiers: what to delegate and what to sign off

A practical way to decide is to sort tasks by what goes wrong if the agent gets them wrong. The tiers below are our framework, built on the sources in this article, not a regulatory standard.

The OWASP security project calls this risk "excessive agency": an agent with more functions, permissions or autonomy than its job needs. Its guidance on excessive agency gives two examples that map onto the table: an agent that only summarises email needs read access, not the ability to send or delete, and an agent that can delete a user's documents should not do so without the user's confirmation.

Three actions that should wait for a person

Payments

Payments are the clearest case. The UK government's Stop! Think Fraud advice for businesses describes payment diversion fraud as one of the most damaging scams facing UK businesses, including fake invoices with updated bank details sent from hacked or lookalike supplier email addresses. Its advice is to confirm both old and new account details using a phone number you already know, to use sign-off processes, and to separate duties so no one person both approves and pays invoices. Some companies wait 14 or 30 days before approving new supplier details.

An agent that pays invoices on its own is effectively one person approving and paying, and it is reading exactly the kind of email the fraudsters write. Let it prepare the payment and flag anything new or changed. Keep the approval, and any change of bank details, with a person. Until Stripe's announced spending limits for agents arrive, approvals are the control to rely on. Stripe's two-party approvals can pause an action for a named reviewer or block it. For an outbound payment, transfer, payout or currency conversion, that rule applies only when an agent-tagged API key starts the action. The reviewer has to be someone other than the person who started it.

Emails to customers

A draft that sounds wrong costs you a minute. A sent email that promises the wrong price, shares the wrong customer's details or goes to people who never agreed to hear from you is much harder to take back. In the UK, the ICO's guidance on electronic mail marketing under PECR says that unsolicited marketing emails to individual subscribers, including sole traders and ordinary partnerships, need their consent or a valid soft opt-in; that corporate subscribers do not; that you must provide a valid contact address so people can opt out; and that using a bulk-email platform does not normally move that responsibility away from you. An agent does not change who is responsible either. Have it draft; have a person send, at least until you have seen enough of its drafts to trust a narrow, fixed type of message.

Deleting data

Deletion looks like tidying up, but it has legal weight in both directions. GOV.UK says a limited company must keep its company and accounting records for 6 years from the end of the last financial year they relate to, and longer if the records show a transaction that covers more than one accounting period, the company has bought something it expects to last more than 6 years, the Company Tax Return was sent late, or HMRC has started a compliance check. GOV.UK says you can be fined £3,000 by HMRC or disqualified as a company director if you do not keep accounting records. At the same time, the ICO's guidance on storage limitation says you must not keep personal data for longer than you need it. The ICO marks this page as under review because of the Data (Use and Access) Act, and says it may change. An agent cannot know which side of that line a file sits on unless you tell it, so deletion should always be a request it puts to you.

How to decide what to delegate

For any task you are thinking of handing to an agent, five questions sort it into the right tier.

1. Can it be undone? If a mistake can be reversed in a minute, the agent can act and you can review later. If not, it prepares and you approve.
2. Who sees the result? Anything that reaches a customer, supplier, employee or official body needs a person's eye first.
3. Does it involve money or personal data? If so, give the agent the least access that does the job, and keep high-impact steps for approval.
4. Where does the input come from? An agent reading emails from strangers should not hold the power to pay, send or delete on its own, because of prompt injection.
5. Can you check it quickly? If approving takes as long as doing the job yourself, the agent is not saving you time on that task.

The NCSC adds a question before all of these: is AI really needed, or could the process be simplified or automated in a lower-risk way? Its advice is to start with tightly bounded pilots on clearly defined tasks and widen the scope only once you trust the results. Mapping your own tasks to these tiers is where most of the thinking happens, and it is the kind of work Evoogen helps small businesses with.

What it costs

The software is often the smaller cost. Claude Duet is included in Claude's Pro and Max plans at no extra cost during the research preview. It uses that plan's usage limits, including its background checks, so it can use up the allowance sooner. It is not on Team or Enterprise plans yet. Gusto says there is no separate fee to connect it to ChatGPT or Claude, although you need a plan on those platforms with the right features. Stripe says there are no monthly fees or minimum balances for a Treasury financial account. Sending money is priced separately. Stripe's Global Payouts pricing, charged from the financial account, lists £0.50 for a UK local bank transfer and $1.50 for a US one, plus cross-border and currency-conversion fees where they apply. Per-seat prices for the AI tools are in our guide to what a small team pays per seat.

The real costs are your time to review, the time to set up access and rules properly, and the cost of a mistake that gets through.

A worked example (hypothetical). Assume a business pays 40 supplier invoices a month and that checking and keying each one takes about 6 minutes, or 4 hours a month. With an agent preparing the payments, assume approving each takes about 1.5 minutes, or 1 hour a month. That saves about 3 hours a month. If the owner's time is worth £40 an hour, that is about £120 a month. Now assume one diverted payment of £5,000 gets through because the agent was allowed to pay on its own. That single loss wipes out roughly 42 months, or three and a half years, of the time saved. These figures are assumptions for illustration, not measurements, but the shape of the sum is why the approval step pays for itself.

What a well set-up agent looks like

• Approval requests you can actually judge. The request shows the exact amount, payee, recipient or text, not a vague summary. Anthropic says Claude Duet shows exactly what it is about to do and tells you which email, file or spreadsheet a number came from.
• The control sits in the system that moves the money. OWASP advises enforcing authorisation in the downstream system rather than relying on the AI to decide whether an action is allowed. Approvals set in your bank, payment or payroll platform hold even if the agent is confused.
• Least access. Read-only where possible, write access only where the task needs it, and no long-lived credentials if you can avoid them, as the NCSC recommends.
• A named owner and a way to stop it. The NCSC says you should know who owns the agent, who approves its access, who monitors it and who can stop it, before it touches real systems. Its blunt test: "If you cannot understand, monitor or contain an agent's actions, it is not ready for deployment."
• Data terms you have read. Gusto points out that once data reaches ChatGPT or Claude, that platform's privacy terms apply, not Gusto's, and asks consumer-account users to turn off model training first. In its Tech Futures report on agentic AI, which the ICO describes as its early thoughts, it says organisations remain responsible for the data protection compliance of agents they deploy, and flags systems connected to data they do not need, or with no way to monitor or stop them.
• Approvals that stay meaningful. If you find yourself tapping "approve" dozens of times a day without reading, the control has stopped working. Move routine low-risk items down a tier, or reduce what the agent prepares, rather than approving blind.

The bottom line

The agent tools announced and updated this week are useful where they can prepare real work inside the systems you already use. Give them the reading, sorting, drafting and preparing. Keep payments, customer emails, deletions, signatures and bank detail changes behind an approval you actually read, and keep the riskiest changes away from the agent altogether. Start with one bounded task, check the results for a few weeks, and widen access only when the evidence supports it.

If you want this set up for your business, Evoogen can map your workflows, decide with you what an agent may do on its own and what needs your sign-off, and implement it with approvals, access limits and logs in place. See how Evoogen can help.