AI Agents for a Small Business: What to Hand Off First, and What Runs in Slack
If you run a company of 5 to 100 people on Slack and you are weighing an AI agent for your small business, you have to pick its first job. Asked which task they would outsource to AI, owners put bookkeeping and taxes first, at 17 percent, in QuickBooks' 2026 survey. In job posts that hire people to work inside Slack, the hours sit in status updates, chasing and files, and a wrong entry in the books or a wrong line to a client is expensive to fix. This guide sorts your week's jobs by what each connected tool lets the agent do and what a mistake would undo, then gives you a worked Slack thread and a first-week plan.
The short answer
- Write down the jobs that repeat every week and the tool each one lives in.
- Mark each job read-only, draft or write. Start with the read-only version of the job that takes the most hours.
- Add writes one at a time, each behind an Approve card, starting with the ones you can undo most easily.
- Put the job on a schedule as a read-only run first, and watch it for a week before it writes anything.
- Keep phone calls, anything a client reads before a person has checked it, refunds, pricing and tax filing with a person.
What an AI agent for a small business is
Anthropic's engineering team separates workflows from agents in Building effective agents. Workflows are "systems where LLMs and tools are orchestrated through predefined code paths", while in agents the model directs its own use of tools. The post recommends "finding the simplest solution possible, and only increasing complexity when needed."
For you, that means a report that is identical every month can stay a plain automation, and an agent earns its place on requests that change from week to week: which clients are late this Monday, what is due on the launch project, what the proposal folder holds. The Kipwise Agent is one example. You mention it once in a channel thread, plain replies in that thread continue the conversation, and it works with each person's own connected accounts (Gmail, Drive, QuickBooks, HubSpot, Asana and others), so it can only read what the person asking can open.
Where the hours go and where mistakes cost most
The same QuickBooks report finds that owners lean on people over programs: 37 percent said they would turn to a human expert for next-quarter cost cuts and revenue growth, and only 20 percent would trust a financial analysis tool alone. It is a vendor survey of 1,305 US owners of businesses with 0 to 250 employees, commissioned in December 2025, so treat the percentages as one company's sample.
Commenters in one December 2025 Hacker News thread split on the books too. The author, who builds small business finance automation, argued that bookkeeping is rule-based and checkable. A commenter writing as a CPA replied that this is "really bookkeeping, not accounting" and that applying GAAP or tax law is harder than that. Another, arguing that language models are poor at judgment, wrote that errors "can be incredibly expensive to fix, if they can be fixed at all." A third said that at small-business scale accountants are mostly paid to coach and pester employees into handing in paperwork on time. These are author reports from one forum, several from people with a stake, not measurements.
Kipwise's read of 124 public Upwork job posts that hire a person to work inside a client's own Slack shows where the hours go: status updates and reporting appear in 58 percent, creating tasks and chasing in 56 percent, documents and files in 45 percent, replying to customers or clients in 37 percent, CRM and data entry in 31 percent, scheduling in 27 percent, inbox triage in 20 percent, and invoicing and payments in 18 percent. Bookkeeping or accounting is the named role in 9 of the 124. Hand off the chasing around a job before the judgment inside it, because the hours sit in reminders and reports while the costly mistakes sit in the entries and the sends.
That sets two different samples side by side: surveyed owners on one hand, public posts that hire help inside Slack on the other. It is our reading, not a measured gap, so use it to check your own week. The hire these posts describe costs about $800 a month at the $10 an hour median across 93 hourly Upwork posts, at 20 hours a week.
Check what each connection cannot do
OpenAI's practical guide to building agents tells builders to rate each tool low, medium or high risk based on factors like read-only versus write access, reversibility, the account permissions it needs, and financial impact. It uses the rating to pause for checks or escalate to a person, and it lists canceling orders, authorizing large refunds and making payments as high-risk actions that should trigger human oversight until confidence in the agent grows.
You are not building the agent, but you can apply the same factors to the connections you give it. Check what each tool connection cannot do before you pick the first job, because the worst case of that job is set by the connection, not by the prompt. A prompt can ask an agent to be careful, but a connection with no way to create a public link or cancel a subscription cannot do either.
With the Kipwise Agent the ceilings are specific. Drive sharing stays inside your company domain and never produces a public link, and a file the agent removes goes to the Trash, where you can restore it. Stripe refunds happen only when you explicitly ask, and cancelling, voiding or deleting stays in the Stripe dashboard. In QuickBooks, a sales invoice the agent creates is posted live rather than as a draft, and deleting one voids it. These facts change the order of a first week, because a Drive tidy-up is a safer start than an invoice run.
The hand-off table
The rows follow the Upwork list above, with a last row for phone calls. Every change from a live request waits for an Approve card that only the person who asked can use.
| Job | What the agent reads | What it can change, and when | What stays with a person |
|---|---|---|---|
| Weekly status update | Tasks and boards in Asana, ClickUp, monday.com, Linear or Jira, deals in HubSpot, a range in a Google Sheet | Nothing to start: it replies in the thread. A new post in the channel waits for Approve, and a schedule is approved once | What a client is told, and what you leave out |
| Chasing open items | Tasks due or overdue, deals and their activities | Drafts the nudge. A Gmail or Outlook send waits for an Approve card showing recipient, subject and preview | Whether to nudge a client you are negotiating with |
| Files and documents | Searches Drive, lists folders, reads Docs, Sheets, PDFs and Office files | Renames or replaces text files, moves files, shares inside the company, moves to Trash, each after Approve | Deleting for good, sharing with outsiders |
| Client and customer replies | Gmail or Outlook threads, help center articles | Writes drafts in your Drafts. A customer-visible reply in a support tool is its own Approve step | Complaints, refunds, anything legal |
| Inbox triage | Searches and reads Gmail or Outlook, including attachments it can open | Nothing without Approve. A matching email, such as a sender and a subject word, can start a job you approved once | Replying to anything sensitive |
| CRM upkeep | People, companies, deals, notes and tasks in HubSpot or Pipedrive | Creates or updates a record, logs a note, adds a task, moves a deal, only when you ask and approve | Pricing, forecasts, who owns the account |
| Scheduling | Your own Google or Outlook calendar | Creates, moves or deletes events on your own calendar. No attendees unless you ask, and Outlook events never get invitees | Booking with people outside your company |
| Invoices and money | Xero or QuickBooks reports such as aged receivables, invoices and bills, Stripe payments | Creates or approves an invoice or records a payment after Approve. Stripe refunds only on an explicit ask | Tax filing, ledger entries, refund decisions, pricing |
| Phone calls and anything said out loud | Nothing: it works in text | Nothing | The whole job |
Several of these rows have their own guides: status updates without an ops coordinator, follow-ups that fall through the cracks, keeping a CRM clean from Slack, chasing overdue invoices, and weekly client updates. If your first hire would have been a role, not a job, start from the role guides for a chief of staff, an operations manager, an email assistant or a scheduling assistant.
Pick the first job with four checks
Run each job on your list through these in order.
- Check whose logins cover the job. The agent works with the permissions of the person who asks, so it cannot read a mailbox, deal or company file that person cannot open. A job that needs your Drive, your bookkeeper's QuickBooks and a colleague's HubSpot should wait, or be split so each person asks for their own part.
- Look for a read-only version, such as a report, a list or a lookup. If the only version writes, the job is not a first job.
- Ask what one wrong write would undo. A renamed file is cheap to put back. A sent email, a posted invoice or a refund is not.
- Count the hours. Multiply times per week by minutes each. Our guide to agentic workflows for a small Slack team has the arithmetic, and the guide to briefing a delegated task covers writing the request so the work does not come back.
Take Elena, a made-up owner of a 15-person web services firm that runs on Slack, Gmail, Drive, HubSpot, QuickBooks Online and Asana. She was about to post a part-time admin role. Her week holds a Monday status round, chasing clients for assets and late invoices, tidying project folders, CRM notes after calls, booking calls, and a weekly client email. Chasing and the status round take the most hours, and both can start as reads. The invoice chase touches money, so she starts with the read half: the aged receivables report and the open Asana tasks, side by side, as one Monday read-only job. Booking calls stays with her.
A worked Slack thread
Here is Elena's thread. It is made up, not a customer story, and the exact wording of the cards will differ.
> Elena, #ops: @Kipwise my Monday jobs. List the Asana tasks due this week by owner, and the QuickBooks invoices more than 30 days late. Read only for now. > > Kipwise Agent: Eleven tasks are due this week, grouped by owner, each linked. Two invoices are more than 30 days late, from the aged receivables report as of this morning. > > Elena: Draft a polite nudge to the first client, in my voice. > > Kipwise Agent: The draft is in your Gmail Drafts. Send it to the client? Approve or Deny. > > Elena: Approve. Now post both lists here every Monday at 9. > > Kipwise Agent: I will post both lists here every Monday at 9. This schedule makes no changes on its own. Approve or Deny.
In that thread the first run was read-only, so Elena saw the data before anything moved. The nudge went through its own card, which showed the recipient, the subject and a preview. The schedule she approved can only read.
The schedule is where a read-only start pays off. Approve a schedule as read-only first, because approving a scheduled task also approves the changes it may make on its own, and later runs do not ask again. A schedule approved with writes on its list keeps making those writes on every run without a fresh card. A read-only schedule keeps the cards: if the agent later wants to write, that change shows a new Approve card, and you decide again.
What to keep with a person
- Phone calls. The agent works in text and does not make calls.
- Anything a client reads before a person has checked it, until you have weeks of drafts that went out unedited.
- Refunds, price changes and money decisions. Tax filing and ledger entries are not among the actions the agent lists for Xero or QuickBooks.
- Choosing the first job. The four checks above are a judgment about your business.
- Complaints and relationship calls, where the other person expects a person to have read the message.
When it goes wrong
- A connection is missing. The agent offers a Connect link when a request needs one, and only you can complete it. Once you connect, it carries on with the original request.
- The data is stale. If the aged receivables list names a client who paid last week, fix the source record first. The agent reads what is there, and it prefers saying "I could not find that" to guessing.
- An approval card expires. Cards expire after 30 minutes, and an expired card means the action does not run. That is the safe default. Ask again when you are back.
- A scheduled run fails or goes quiet. Ask the agent what happened on previous runs, including failures, and list your jobs to see what is still live. The guide to scheduling recurring agent jobs covers what to check weekly.
- The same job fails twice. OpenAI's guide names exceeding a failure threshold as one of two triggers for human intervention, the other being high-risk actions. For a small team the practical version is to stop, read why it failed, and fix the job before asking again.
The cards themselves are covered in adding human approval to AI agent workflows in Slack.
How to tell it worked
Run the first week like this. On day one, write the list and mark each job read-only, draft or write. On day two, ask for the read-only version of one job and compare it with what you would have produced by hand. On days three and four, ask for drafts and note how many you approve unchanged. On day five, approve the read-only schedule. Then watch the next two Mondays.
Keep three numbers: the minutes the job took by hand before, the minutes it takes now, and the share of drafts you approved without edits. Add one count, the open items that closed without you chasing them. If the minutes fall and the edits are rare, take the next job off your list. If edits stay high, the job has hidden exceptions, so narrow it until the edits fall. If what is left is judgment and relationships, that is the part to hire for. The hire no longer has to cover status chasing, and the cost guide for a virtual assistant helps you size what remains.
What to do next
Today, write the repeating jobs in your week and the tool each one lives in, then mark each read-only, draft or write. Circle the read-only job with the most hours and the one person whose logins cover it. If your team works in Slack, mention the Kipwise Agent once in a thread, paste the list, and ask for the read-only version of that one job first. It is $10 per user per month with a 3-user minimum, and there is a free trial, so you can run the first read-only week before you pay.
