Most AI automation in small businesses so far has been assistive: it drafts the email, suggests the reply, summarizes the document, and a human still does the actual sending and filing. The newer pattern, agentic automation, is the AI carrying a multi-step task to completion on its own: read the incoming invoice, match it to the purchase order, flag the discrepancy, enter it into the books, and queue the payment.
The technology that makes this feasible now is tool-using models. Instead of only producing text, the model can call defined functions, look up a customer, create a calendar event, post to an accounting API, and chain those calls based on what it finds. Standards like the Model Context Protocol have made wiring a model to a business's actual tools less of a bespoke engineering project than it was a year ago.
Where it's worth doing
The tasks that suit agentic automation are high-volume, rules-based, and annoying: reconciling payments against invoices, chasing overdue accounts with a sequence of increasingly firm messages, sorting inbound email into the right queue and drafting first responses, keeping product data in sync across a website and a marketplace listing. These are jobs where a human adds little judgment but a lot of hours.
Where it isn't
Anything where a wrong action is expensive and hard to reverse, sending money, making commitments to customers, deleting records, should stay behind a human approval step. The agent prepares the action; a person clicks confirm. That single checkpoint removes most of the risk while keeping most of the time savings.
The failure mode to design around
An agent that is 95 percent reliable sounds good until you realize the 5 percent happens unsupervised. The businesses that get this right build in constraints the model cannot talk its way past: hard limits on amounts, allowlists of who it can contact, validation that rejects placeholder or malformed data, and a log of every action taken that the owner can actually review. The model reasons; the surrounding system enforces.
Starting scope
Pick one task, run the agent in propose-only mode for a few weeks so you can see what it would have done, then let it act on the low-stakes cases while the borderline ones still route to a person. The goal is not to remove humans from the loop, it is to move them from doing the task to reviewing the exceptions.