AI agents for a growing business: start with one job, not a platform.

A year ago most business conversations about AI were about chat: a bot on the website, a writing assistant for the team. The conversation now is about agents, software that can read a request, decide what to do, and take actions in the tools a business runs on, such as the inbox, the CRM, the spreadsheet or the accounting system.

Why this became practical

The hard part of an agent was never the language model. It was connecting it safely to everything else. The Model Context Protocol (MCP), an open standard for connecting AI applications to tools and data, has become a common answer. In December 2025 the Linux Foundation formed the Agentic AI Foundation, with MCP contributed by Anthropic as one of its founding projects alongside Block's goose and OpenAI's AGENTS.md. A neutral home for the standard makes it easier for software vendors to offer connectors, and easier for businesses to avoid being locked into one supplier.

Pick one job with clear value

The agents that pay off in a small or mid-sized business do one job well, which is how we approach custom AI and agents. Good first candidates are repetitive, frequent, rule-heavy tasks where the data already exists and a mistake can be caught before it matters.

• Reading incoming enquiries, pulling out the details, and drafting a reply for a person to approve.
• Matching invoices or purchase orders against records and flagging the ones that do not agree.
• Answering staff questions from internal documents, with a link to the source every time.
• Preparing a weekly summary from several tools that someone currently copies by hand. Often a plain workflow automation does this without any AI at all.

Prove it on real data before it goes live

Demos on tidy examples always look good. Before anyone relies on an agent, run it on a real sample of your own documents and requests, and write down every case it gets wrong. That list becomes the test set the system is checked against every time something changes, and it is the honest answer to the question every owner asks: how often will it be wrong?

Guardrails that make it safe to use

• Human approval for anything that sends, pays, deletes or commits the business to something.
• The narrowest permissions that do the job. An agent that drafts replies does not need to delete records.
• A clear fallback: when it is unsure, it hands over to a person with the context attached.
• Tracing and cost tracking from day one, so you can see what it did, why, and what it cost.
• A plan for prompt injection, where text inside an email or document tries to give the agent instructions. Treat what it reads as data, not commands.

Start with one job, measure it honestly against how the work is done today, and only then add the next. Businesses that do this end up with a few dependable agents. Businesses that start with a platform often end up with an impressive demo nobody trusts. See how we run this in AI and automation, or talk to us about your first job.