Always-On AI Agents for Small Business: What to Connect, What to Approve, and What to Keep Off-Limits

Most AI tools wait to be asked. You open a chat, type a request and get an answer. The new generation of assistants works the other way round. It watches the apps you connect, decides what needs your attention and keeps working while you are with a client or asleep.

For a founder running a 20-person service business, that is an appealing idea. Somebody finally keeping an eye on the inbox, the calendar and the unpaid invoices. But an assistant that acts without being asked is only as safe as the access you give it and the rules you set before it starts.

This guide covers the three decisions that matter most before you switch one on: which systems to connect, where your approval should sit, and what to keep off-limits entirely. It also covers the data to tidy first, because a proactive assistant will act on whatever it finds.

What is an always-on AI agent?

An always-on agent is an AI assistant that runs in the background, checks your connected apps on its own and brings work to you rather than waiting for a prompt. Two recent launches show where this is heading.

On 23 October, Anthropic opened a research preview of Claude Duet, which it describes as a proactive agent built for professionals and small business owners. Each morning it sends a short brief on the most important items across your connected apps, checks those apps every few hours, and messages you when something needs attention. It has its own virtual machine and browser, so tasks continue when your laptop is closed.

A few weeks earlier, on 29 September, OpenAI introduced dots, described as always-on agents with their own cloud computer that can work towards your goals in the background. You can message a dot in ChatGPT, Slack or Teams, and when you are not working with it, it looks for ways to help using the apps you have connected.

Can a small business use these assistants today?

Some can, with caveats. Both are early.

• Claude Duet is a research preview available by waitlist, starting with Pro and Max subscribers in the US. Anthropic says it may still misread a thread or misjudge what is urgent.
• OpenAI dots are rolling out to Pro and Business Premium users in eligible markets, with Enterprise users able to try a beta if their admin enables it. OpenAI says plainly that dots can still make mistakes, so consequential work should always be reviewed.

Treat both as early products you test on low-risk work, not as staff you hand the business to. The decisions below apply whichever assistant you choose, and they apply to any agent that can act without a prompt.

Which systems should you connect to an always-on agent first?

Start with the systems where reading is useful and mistakes are cheap. A proactive assistant earns its keep by noticing things. It does not need write access to your finance system to do that.

A sensible first set for most service businesses:

• Calendar. Spotting clashes, preparing briefs before client calls and flagging travel conflicts are low-risk, high-value jobs.
• Email and team chat, read first. Surfacing messages you have missed and drafting replies for you to send.
• Your CRM, for context. Contact and deal history make drafted follow-ups far better.
• Project or task tools. Overdue tasks and stalled work are exactly what a daily brief should catch.

Hold back on systems where a wrong action costs money or trust: accounting, payroll, banking, e-signature and anything holding client files. Anthropic's own examples include checking for unpaid invoices and preparing payroll, so the capability exists. That does not mean it should be your first connection.

One detail worth knowing: connections are often shared. OpenAI's dots privacy and safety FAQ says plugin permissions are shared across dots, ChatGPT and its other products, and Claude Duet carries over the connected apps from your Claude account. Check what is already connected before you start, not just what you plan to add.

Where should approvals sit with an always-on AI agent?

Put an approval anywhere an action leaves your business, moves money or cannot be undone. Everything else can usually run on its own.

Both vendors have built defaults along these lines. Anthropic says Claude Duet reads, drafts and prepares work on its own, but before it sends a message, makes a payment, signs a document or deletes anything, it shows you what it is about to do and waits. OpenAI's FAQ describes three levels for dots: the most sensitive actions, such as changing a password or transferring money, need you to take over and do them yourself; others, such as permanently deleting data, may need approval each time; and some, such as recurring messages, can be approved in advance.

Defaults are a starting point, not your policy. OpenAI's Custom Rules let you allow, require approval for or block specific actions, for example telling a dot never to send email. Use that kind of control to match your business, not the vendor's average customer.

Two habits make approvals work in practice:

1. Be specific when you approve. OpenAI notes that approving one message does not give ongoing permission to contact people. Say who it goes to, what it says and when.
2. Watch for approval fatigue. If you are approving twenty drafts a day without reading them, the approval has stopped protecting you. Narrow what the agent drafts rather than approving faster.

What should you keep off-limits for an AI assistant?

Some things should stay out of reach even with your approval. Anthropic already blocks a few in Claude Duet, such as trading securities and moving money between accounts, and says its sensitive-information classifier is designed to reject sharing card numbers and government identification.

Your own list should go further than the vendor's. For a typical service business, consider keeping these off-limits:

• Bank and payment accounts, beyond read-only reporting
• Client contracts, engagement letters and anything privileged
• HR, payroll and personal files about staff
• Passwords and admin settings for your core systems
• Any folder or channel where clients share sensitive documents with you

Off-limits means not connected, not "connected but told not to look". OpenAI notes that disconnecting a service stops new access but does not delete information the dot has already built into its context. Deleting the dot deletes that context, but individual memories cannot currently be viewed or edited. So the safest boundary is the one you set before the first connection.

What data should you tidy before switching one on?

A proactive agent reads your systems as they are, not as you wish they were. If your CRM has three records for the same client, the agent's drafted follow-up will pick one. If your calendar is full of placeholder holds, the morning brief will treat them as real.

Before you connect anything, spend a short session on:

• Duplicates. Merge duplicate contacts and companies in your CRM.
• Stale items. Close old deals, archive finished projects and clear placeholder calendar holds.
• Shared folders. Check who and what can see each folder, and move sensitive files out of general shares.
• Naming. Make sure the fields the agent will rely on, such as deal stage or invoice status, mean the same thing to everyone.

This work pays off even if you never switch an agent on. But it matters more now, because the agent will act on bad data with confidence.

How do you check what an always-on agent did?

Know where its activity lives before you rely on it. OpenAI says dots show ongoing and delegated tasks in an Activity View, where you can review steps and redirect or stop the work. Anthropic says Claude Duet notifies you when a task is complete or needs review, and that you can disconnect any app it has access to.

Set a rhythm. In the first few weeks, look at what the agent did each day, not just what it asked you about. You are checking two things: did it miss anything it should have caught, and did it do anything you would not have done?

If you need to know who in your team owns an agent, what happens when they leave and how to retire it, we covered that in who owns the work when an agent is a colleague.

A decision table before you connect an app

Run each app through this table before you connect it.

If an app does not fit cleanly into a row, leave it out for now. You can always connect more once the first set is working.

The real decision is the boundary, not the tool

Always-on assistants are a genuine shift. An agent that notices a wrong meeting date, a forgotten invoice or a missed email before you do can save a small team real stress. The products will improve quickly, and the choice between them will change.

What will not change is the decision in front of you: what it can see, what it can do alone, and what it must never touch. Founders who set those boundaries deliberately, starting narrow and widening as trust builds, will get the benefit without the clean-up.

At Nuevexa, we help service businesses connect agents to the tools they already pay for, with approvals and off-limits areas settled before anything goes live. See our AI agent implementation service, or talk to us about an AI consulting plan if you are still deciding where agents fit.

Book an automation scan to see which of your systems are ready for an always-on agent and which should wait.