AI Agents for Business Operations: How to Start Safely

AI agents are the talk of the moment. Simply put, an AI agent is AI that doesn't only answer questions but can also carry out work steps: look up data, fill in records, prepare drafts, and hand over to a person when needed. For a business, that promises a lot of saved time. But an agent that can act can also act wrongly. This article covers which tasks suit agents, the principles that keep them safe, and why evaluation must happen before customers ever use one.

Automation, chatbots, and agents: the difference

• Regular automation follows fixed rules. For example: every time a form comes in, send a confirmation email and log it in a spreadsheet. The result is predictable, and often that's enough.
• An AI chatbot answers questions in flexible language, ideally from your official documents.
• An AI agent chooses its own next step from a list of allowed tools, such as checking an order status, writing a note in the CRM, and then deciding whether to call in an admin.

Operational tasks that suit an agent

• Sorting incoming messages, then forwarding them to the right person with a summary.
• Preparing draft replies that already include the customer's order or booking data, for an admin to check before sending.
• Filling in the CRM from conversations, such as needs, programme interest, and unanswered questions.
• Compiling daily reports from several sources, such as orders, payments, and complaints.
• Answering status questions, like "has my order shipped?", by checking the real data.

What should stay with people

• High-value decisions, such as refunds, discounts, or contract changes.
• Sensitive or emotional complaints that need empathy and authority.
• Price negotiations and a customer's final decision, such as whether to sign up.
• Anything whose data isn't tidy yet. An agent can't fix messy data.

Seven principles to keep an agent safe

1. Least privilege. Decide exactly which tools the agent may use, and separate read-only access from permission to change data.
2. Answers grounded in official data. When no source supports an answer, the agent must decline or hand over to a person, not make something up.
3. Clear handover to people. Define when the agent must stop, and send a conversation summary so the customer doesn't have to repeat themselves.
4. Human approval before important actions, such as sending messages on the business's behalf or changing a payment status.
5. A log of every step. Every agent action is recorded, so it can be reviewed when something goes wrong.
6. Protect personal data. Mask phone numbers, emails, and sensitive data before storing them or sending them to an AI service.
7. Spending caps and fallbacks. Set daily usage limits and plan a way out when the AI service fails.

Evaluate before launch

An agent isn't tested by trying a few questions and feeling good about the results. Prepare a list of test cases that represent real conversations, and decide for each one what should happen: answered, declined, or handed over to a person. Run the whole list, count how many match, and fix the misses. Repeat every time the rules or the AI model change.

An agent that hasn't passed evaluation is better switched off than left guessing in front of customers.

A real example: the Numekara admissions assistant

At Numekara, the education business we run, we built an AI assistant to answer prospective students and parents. It answers only from approved programme knowledge sources, and the system rejects any answer that doesn't cite a valid source. Price questions are answered from the latest price data. Before anything is stored, phone numbers, emails, child identities, and school names are masked.

The assistant also hands the conversation to an admin when a prospect asks to speak to a person, raises something sensitive, negotiates on price, asks to change a schedule, or reaches the decision to enrol. The admin receives an alert with a summary of needs, programme interest, and open questions. We also prepared an evaluation set with cases that should be answered, declined, or handed over.

Even so, as of 30 October 2026 we have switched the assistant off. The reason is simple: it has no user interface yet, and its evaluation set has not been run. In line with the principles above, we chose not to release an assistant that hasn't proven itself through evaluation.

How to start

1. Pick one repetitive job that eats up your team's time, and write down its steps as if instructing a new hire.
2. Check whether regular automation is enough for that job.
3. If you really need an agent, decide which tools it may use, when it must stop, and who receives the handover.
4. Collect real example conversations to use as test cases, with personal data masked.
5. Roll out in stages: start as a draft-writer checked by people, and only grant more authority once evaluation results are consistent.