Renzo DemartiniIn short
- Use an agent only where judgement is needed. Fixed steps stay as tested code or ordinary automation.
- Give the agent read and draft access first, and keep payments, bank details and external sending locked.
- Budget the whole run, and prove the stop works before live work depends on it.
An agent is software that decides its own next step. That is useful, and it is a risk a board should price.
Five questions turn that into operating decisions: the work, the access, the approval, the cost and the stop.
Choose work that needs judgement
Known steps stay as code or automation, and an agent takes only unfamiliar exceptions
| Work | Starting approach |
|---|---|
| Add known figures | Tested code |
| Follow fixed steps | Ordinary automation |
| Investigate an unfamiliar exception | Bounded agent with review |
A proposed comparison, not a ranking of products.
Illustrative figures, not client data.
Microsoft says, ‘AI agents use a generative model to decide which knowledge and tools to use at each step.’ That makes an agent different from a fixed sequence, and the boundary matters.
Ask what decisions the model must make. If the steps are known, question whether an agent adds value. Anthropic recommends ‘finding the simplest solution possible, and only increasing complexity when needed’.
Apply the same test across finance, sales and operations. One convincing demonstration does not approve every other use.
Decide what it may touch
Two sample actions are allowed and three are locked, because writing needs more control
| Action category | Permission |
|---|---|
| Read approved operational records | Allowed |
| Draft an internal recommendation | Allowed |
| Change bank details | Prohibited |
| Pay money | Prohibited |
| Send externally | Prohibited |
A sample access schedule for an internal exception agent.
Illustrative figures, not client data.
Separate reading from writing. Give each agent only the access its job needs.
Ask management to show a prohibited action failing. A written instruction is not the same as enforced access.
Record the systems, information and recipients involved. Get privacy and legal advice where your obligations are unclear. These are proposed controls, not legal permission to share data.
Keep approval with a person
My finance fleet has about 10,000 tests, and 87% of its scheduled steps use no model
Published
Every
money decision approved by a person
Published
~10K
automated tests
Published
87%
of scheduled steps are pure code, with no model call
Published figures about my own fleet, not sample figures and not a benchmark for yours.
Source: The finance fleet
I built a fleet with tested code in the middle. AI works at the edges, where judgement is needed. People keep the decisions, the money and the relationships. The finance fleet page describes it.
Test counts alone do not prove a system safe. Name the person who reviews each consequential action, and show them the evidence and the exceptions first.
OpenAI’s workspace agents announcement says, ‘You decide what tools and data it can use, what actions it can take, and when it needs approval.’ Match those settings to your decisions.
Budget for the whole run
A sample agent costs A$500 a month in cash, with review hours budgeted apart
Cash
A$500
Monthly cash budget
A$150 model usage, A$100 software, A$250 outside monitoring and maintenance.
Hours
10 hours
Internal review a month
Counted as capacity and budgeted separately.
No claim
None yet
Hours saved and cash saved
Not measured, so this sample makes no payback claim.
Planning assumptions, excl. GST. Not vendor prices.
Illustrative figures, not client data.
Count retries, exception review and failed runs. A cheap successful run can hide expensive work around it.
Set an alert before the budget is exhausted. Agree what pauses at the limit and who can authorise more spending.
Do not approve on a vendor’s headline saving. Released hours are capacity, not cash.
Prove the stop works
A stop drill proves access is removed, the queue is kept and a person takes over
- 01Owner triggers stop
No new tasks start.
- 02Access is revoked
Prohibited actions fail.
- 03Queue is retained
Held work stays visible.
- 04Person takes over
The manual process resumes.
- 05Restart is considered
The owner approves a restart only after checks.
A sample stop drill and acceptance record.
Practise stopping before live work depends on the agent. Include tasks already running, not just the next scheduled one.
Keep the records needed to investigate a failure. Name a backup who can act when the owner is away.
The National AI Centre’s guidance includes ‘Maintain human control’ and ‘alternative pathways for critical functions’. Your board needs evidence that these work in its own business.
What to do first
Four decisions come before any agent touches live work
- 01Name the work
List the decisions the agent must make.
- 02Set the access schedule
Read and draft first. Lock payments, bank details and external sending.
- 03Budget the whole run
Cash and review hours, kept apart.
- 04Run a stop drill
Before any live work depends on the agent.
Settle the boundary on paper before anything is connected.
Common questions
Is an AI agent just a chatbot?
Not necessarily. A chatbot returns an answer. An agent can choose tools and actions across several steps, which is why its access needs a limit.
Should every process become an agent?
No. Anthropic separates fixed workflows from model-directed agents and recommends the simplest workable solution first.
What should the board see before rollout?
A named owner, test evidence and a demonstrated stop. These proposed checks reflect the National AI Centre’s ‘Test and monitor’ and ‘Maintain human control’.
Chartered Accountant (CA ANZ) and finance executive, based in Canberra. Practical AI and automation for SMEs, and adviser to owners, CEOs and boards on integration and finance.