AI for SMBs: who signs when an agent decides for you?

Picture a business owner whose team has just set up an AI agent to answer customer emails. His question: "How far do I let it go?"

That's the right question. And it isn't a technical one. It's one of the first questions of a real AI strategy for an SMB.

We spend a lot of time asking what an AI agent is capable of. We should spend more time deciding what it's allowed to do on its own.

Because an agent doesn't hesitate. You give it a task, it does it. The real decision is yours, and it happens before, not after.

Here's a three-column grid. You place every action the agent might take into one of them.

Column 1: on its own. Reversible, low-stakes actions a junior employee would handle without checking with you. Answering a routine customer question. Sorting a request. Drafting a reply. If the agent gets it wrong, you fix it in two minutes and no one gets hurt.

Column 2: with approval. Actions that commit money, a client or your reputation, but that are part of normal work. Changing a price. Issuing a refund above a certain amount. Sending an offer. The agent prepares, a human approves. The key is the threshold: below it, the agent proceeds; above it, it waits.

Column 3: never. Actions that change the rules of the game. Signing a contract. Changing payment terms. Granting access. Speaking for the company on a sensitive matter. You don't hand that to a machine, period.

Bad surprises almost always come from the same place: a column 2 or 3 action that quietly ended up in column 1, without anyone deciding it.

An example, imagined but plausible. An agent handling returns decides refunds on its own. As long as the amounts are small, all is well. Then a 4,000 $ case goes through, because nothing told it to stop there. The problem isn't the agent. It's the grid that didn't exist.

Notice that this grid is nothing new. It's exactly what you already do with your employees. A clerk doesn't have the same latitude as a director. You have thresholds, approvals, signatures. AI doesn't change that principle. It just makes it visible, because you have to write it down for the machine to understand it.

And that's good news. It means you already know how to do this. You don't need to become an AI expert to govern agents. You need to put your rules in writing.

That's an important part of an AI transformation plan for an SMB: before you plug anything in, you decide who signs. Not after the first incident. Before.

So take one action you'd like to hand to an agent this year. Just one. Which column does it fall into: on its own, with approval, or never?