DEV Community: T.M. Gunderson

Leaderboards Lie: The 30-Minute Test That Picks Your AI Tool Better Than Any Benchmark

T.M. Gunderson — Thu, 15 Oct 2026 09:00:11 +0000

Gemini 4 Argon hit #1 on the Vals Index at 68.9% this week — the same week Nate B. Jones published a video titled "AI benchmarks are dead." Both are true. Benchmarks measure a model's ability on abstract, constructed tasks. Your business runs on specific, concrete ones: the quote you send a contractor, the follow-up email to a customer who ghosted, the cash-flow read on a slow month. A model that tops a leaderboard can still lose on all three.

The leaderboard exists to rank models against each other. It was never designed to answer the only question that matters to you: which of these tools should I actually pay for? That's a question about your work, and the only valid instrument is your work.

So stop watching the leaderboards. Run the test instead. Thirty minutes, three tasks, one honest scorecard.

Step 1: Pick three real tasks from your actual week

Not invented ones. Not idealized ones. Open your calendar and your sent folder from last week and pull three:

One email thread. A customer reply that took you real effort — an objection, a complaint, a price pushback. Copy the incoming message, paste in the context you'd need (customer history, your pricing stance), and ask the tool to draft the reply.
One quote or document. Something with structure and numbers — a quote, an estimate, an invoice summary, a statement of work. Feed it the inputs it needs and ask for the deliverable.
One analysis. A judgment call: "which of these two suppliers is better for us and why," "review this month's numbers and tell me what changed," "summarize this lease and flag anything unusual."

Three different task types, on purpose: drafting, structured output, and analysis. Tools have different strengths across them, and you want to know where the tool fails, not just where it wins.

Step 2: Score against what you would have produced

This is the part most people skip, and it's the whole test. Run each task through the tool, then answer two questions per task:

Usable as-is? Would you send/act on this output without meaningful edits? Yes or no.
Better or worse than your version? Take five minutes, write your own version of the email (you know what you'd say), and compare honestly.

Then a 1–5 score per task, with a simple rubric: 1 = unusable, 3 = usable with edits, 5 = better than what I'd have written.

Fifteen points total across three tasks. That's your number. A tool that scores 13+ on your work is a tool worth licensing. A tool that scores 8 with all its points in one category is a specialist — useful, but not your daily driver. A tool that scores below 7 across the board isn't ready for your business, no matter what the index says.

Step 3: Buy the winner of YOUR leaderboard

Here's the counterintuitive part: the tool that wins your test might not be the one at the top of anyone's public index. It might be the free tier model that happened to nail your customer-email tone. It might be the mid-tier one that got the numbers right and the analysis sharper than yours. That's not a fluke — that's the measurement working. Benchmarks average across millions of tasks; you run thousands. Your sample is small but it's the only sample that pays you.

One honest caveat: your test measures today's model on this week's tasks. If the tool's model updates quarterly, your scores go stale too — rerun the three-task test each quarter before you renew. That's not a burden; it's a built-in escape hatch from lock-in you didn't notice you had.

The protocol at a glance

Pull three real tasks from last week (one email, one structured document, one analysis).
Run each through the tool with the real inputs and real context.
Score each 1–5: unusable → usable-with-edits → better-than-mine.
Total: 13+ = license it. 8–12 = specialist, keep it scoped. <7 = pass.
Rerun quarterly, before every renewal.

Thirty minutes. Cheaper than a wrong annual license, and more honest than any benchmark. The leaderboard can tell you which model the industry loves this week. Only your own work can tell you which one your business should buy.

Want the full tool-selection protocol as a checklist? The AI Automation Starter Kit includes the three-task test template, scoring rubric, and quarterly rerun checklist that turns AI vendor selection into a 30-minute decision instead of a week of tab-hopping.

The Spec Rule: Letting AI Build Internal Tools Without Losing Sleep

T.M. Gunderson — Wed, 14 Oct 2026 09:00:08 +0000

"Have someone review the AI's code" is advice written for companies that have engineers. If you run a 10-person business, you were never going to read the code. That was never your safety mechanism — so stop feeling bad about skipping it, and put something in its place that actually works.

The interesting part: the industry is converging on the same conclusion, for its own reasons. Verification researchers argue that generated code needs machine-checkable correctness, not human eyeballs. Platform vendors are adding deterministic intermediate layers between what an AI generates and what runs in production. And the hobbyists shipping real AI-built projects in public keep landing on the same pattern: write a precise spec, make the build prove it works, then stop fussing over the implementation.

Strip out the enterprise framing and you get something a non-technical owner can actually use. Call it the Spec Rule.

Before an AI builds any tool you intend to keep, write down four things: what goes in, what comes out, what happens when the input is wrong, and how you undo a bad result. No spec, no build. The spec — not code review — is your safety mechanism.

Why the spec beats the review

For a small business, the failure mode of an AI-built tool is rarely "the code is broken." Models write competent code for boring internal tools the way calculators do arithmetic. The failure mode is "the tool does exactly what you asked for, and what you asked for was wrong."

Vague intent is the bug. A spec forces you to fix the intent before the build, in plain language, where you're the expert. And it converts the acceptance question from "is this code good?" — a question you can't answer — to "does this behavior match what I wrote down?" — a question only you can answer.

That's the whole trick. You were never qualified to review code. You are the only person qualified to review intent.

The four fields

1. Inputs

What data the tool touches, where it comes from, and in what shape. "A CSV export from the scheduling system with columns A, B, C" — not "our scheduling data." If the input isn't concrete enough to write down, the tool isn't ready to be built. You're still in discovery, and discovery happens on paper, not in production.

2. Outputs

What comes out, field by field, format by format, and where it lands. Who sees it, when, and what decision it feeds. A tool whose output doesn't feed a decision is a toy — say so in the spec and build the toy on purpose, or change the spec.

3. Edge cases

What should happen when the input is empty, duplicated, absurd, or missing a field. This is where AI-built tools actually break — not on the happy path, but on Tuesday, when the export has a blank row. List at least five ways reality will corrupt your input. If the spec can't answer them, the build will improvise, and you'll find out from the output.

4. Rollback

What happens when the tool is wrong — and it will be, sometimes. How do you undo it? What's the blast radius? A tool whose worst failure costs you a re-export is a different animal from one whose worst failure mass-emails customers or corrupts a live record. If the rollback is ugly, that's not a reason to skip the tool; it's a reason to scope it smaller until the rollback is boring.

Then demand tests — and stop reading

Here's the part that feels illegal the first time you do it: after the build, ask the AI to generate tests that prove each line of the spec. Edge cases included. Then run them.

If the tests pass and the behavior matches the spec, accept the tool. Do not open the code. Do not "just take a quick look." You won't find anything, and even if something looked odd, you wouldn't know what to do about it. Your review happened before the build — that's what the spec was.

This isn't blind trust. It's checking the only artifact in the chain you're qualified to check. The spec is your review; the tests are the build's reply.

One honest caveat: an AI can satisfy a bad spec perfectly. The Spec Rule doesn't make you immune to mistakes — it moves failures from "the tool is broken" (mysterious, requires an engineer) to "my spec was incomplete" (visible, fixable in plain language tonight). That's the trade. You take responsibility for intent, and in exchange, every failure becomes one you can fix yourself.

What the Spec Rule does not cover

Systems of record. The Spec Rule governs draft tools. The moment a tool becomes the place customer data lives, or something money moves through, or something the whole team runs on, it has graduated — add access control, backups, and a named owner, or rebuild it on a supported platform. Promotion from draft is a decision, not a drift.
Customer-facing anything. Internal first, always.
Judgment calls. If a step of the tool involves taste — pricing exceptions, customer language, anything with negotiation in it — the spec should route that step to a human, not to the model.

Tonight's version

Take the spreadsheet workflow you've been meaning to automate. Write the four-field spec: inputs, outputs, five edge cases, rollback. Twenty minutes, no build yet. Two things will happen: you'll find out whether you actually understand the process, and the tool you eventually get back will be the tool you meant.

That gap — between what you would have prompted and what you just specified — is the entire failure mode the Spec Rule exists to close.

Want the spec-writing frameworks and acceptance checklists that go with this? The AI Automation Starter Kit includes spec templates, test-generation prompts, and the guardrail checklists that keep AI-built tools from becoming liabilities.

Hire the Ten-Cent AI Junior: The Delegation Playbook Small Businesses Keep Missing

T.M. Gunderson — Tue, 13 Oct 2026 05:12:59 +0000

When a frontier AI lab ships a new model, the usual pitch is conversation: open a chat, ask anything. Anthropic's latest cheap model, Claude Haiku 5.5, shipped with a different pitch — delegation. Anthropic president Daniela Amodei called it "a great subagent" for "straightforward tasks that come up again and again," and the model's own docs position it for high-volume work: classification, extraction, routing.

At roughly $0.10 per million input tokens — with cached prompt reads around a penny per million — it's a model positioned less as a chatbot and more as a subagent: the junior hire you give routine work to while you (or a smarter model) keep the judgment calls.

Most small business owners treat AI as one assistant. They open a chat window and hand the AI everything: routine work, judgment calls, sensitive replies. That's like running a company where nobody gets hired below senior level — it works until you see the bill.

Here's the advice that's missing from all the benchmark coverage: the cheap model is not the trick. The delegation plan is the trick.

What a Ten-Cent Junior Is Actually Good At

Cheap, fast models are reliable at work with a knowable shape:

Classification: is this urgent, routine, or a complaint?
Extraction: pull action items and client names out of meeting notes
Summarization: condense a thread into a three-line digest
First-pass drafting: produce a rough reply that someone else edits
Skeleton-building: assemble the shell of a report so a human fills in the judgment

What they're bad at: judgment, nuance, novel situations, and anything where a confident-sounding wrong answer costs you a customer.

The Delegation Playbook

Here are four concrete delegations to start with, each with its own escalation rule.

1. Inbox triage drafts

Every morning, a junior agent reads new emails and produces a triage table: sender, topic, urgency, and a draft reply. The draft never sends automatically — it sits in a queue for review.

Escalation rule: If the email is a complaint, mentions legal or refund language, or the agent's confidence on the topic is below roughly 80%, mark it "needs human" and skip the draft entirely.

2. Meeting notes → CRM update drafts

Paste your meeting notes in; the junior drafts the CRM updates — new contact info, next steps, deal notes — as structured records ready to import.

Escalation rule: Any note that mentions a new deal, a risk, or a promise you made gets flagged for you to write yourself. Data-entry is delegable; commitments are not.

3. Weekly report skeletons

Monday morning, the junior assembles last week's numbers into your standard report format, with placeholders for the commentary only you can write.

Escalation rule: If any metric lands outside its normal range, the junior adds a "check this" flag instead of quietly filling in context it doesn't have.

4. First-pass customer replies

The junior drafts responses to routine questions — order status, scheduling, documentation requests — based on your FAQ and macros.

Escalation rule: If the recipient is a high-value client, the thread runs past three exchanges, or the question isn't clearly covered by the FAQ, it goes to you untouched.

Write the Escalation Contract Like a Job Description

Notice the pattern in those four rules. Every delegation comes with three sentences:

What the junior produces — a draft, a table, a skeleton. Never a final output.
What triggers escalation — a condition you can actually test: refund language, confidence below a threshold, an out-of-range number.
What "escalation" means — stop, attach context, hand upward. Not "try harder."

If you can't write those three sentences for a task, you're not ready to delegate that task yet. Start with one where you can.

Why Routing Is the Whole Trick

The benchmark coverage argues about whether the cheap model is "good enough." That's the wrong question. In a small business, no model is good enough unsupervised — the value is that the routing lets you buy 90% of your AI work at ten cents and reserve the expensive tier for the 10% that's actually judgment.

It's also why you don't need to re-architect anything tonight. Pick one recurring task from last week. Write the three-sentence escalation contract. Hand the drafts to the cheap tier for a week. You'll either have a new junior hire, or you'll have learned exactly which part of the task needed judgment — and both answers are worth the experiment.

If you want the full walkthrough with more delegation templates — including the escalation-contract format above — The AI Agent Owner's Playbook covers it end to end, $49 CAD, instant download.

One honest note: we're a $0-revenue small team running a public 14-day experiment on whether this playbook advice actually works — the receipts are here.

SMB Scale Up helps small businesses build AI agent systems that actually work — without the enterprise price tag.

Attacking a Small Business Now Costs $25. 'Too Small to Hack' Is Over.

T.M. Gunderson — Mon, 12 Oct 2026 05:07:08 +0000

For most of the history of small business, your best security control was being boring. Attacks cost money: a skilled attacker's time ran hundreds of dollars an hour, so they spent it on targets worth the spend. "Nobody would bother with us" was never really a strategy, but as a risk calculation it mostly held.

That calculation just broke. In October 2026, security firm Gambit Security published an interim report on a campaign they reconstructed from the attacker's own staging server: one operator, using three open-source AI agent frameworks, autonomously attacking hundreds of online retailers — at a marginal cost their own logs put at $25.46 per company, ranging from $3.13 to $79.31.

Twenty-five dollars. The price of a delivered pizza, to attack a business — with the patience, persistence, and creativity of software that never gets bored. The whole campaign's model spend was estimated at $12,000–$18,000 over roughly seven weeks.

What actually happened

The facts, from Gambit's interim report (which security newsletters including Metacurity picked up):

Three open-source AI harnesses ran nearly the entire attack chain: one searched for vulnerabilities, one executed exploits end-to-end, one orchestrated the campaign and gave tactical guidance. The orchestrator ran with 121 skills installed, 78 of them attack skills.
Between September 10–15 alone, 105 attack projects launched. At least 27 companies were compromised to varying degrees. The activity traces back to July 2026 and was still running at publication.
The recoverable impact: at least 600,000 unexpired card details from two companies, card-skimming scripts injected into the websites of five, and some level of access at organizations including a Fortune 500 hospitality company and a major US airline.
Where access was achieved, it usually took less than a day — in many cases, hours.
The human's role? About 1,951 short prompts across 260 sessions. A few lines per target. In Chinese, roughly: "read the vulnerability report and start." "Dig deeper into the API." "Goal oriented — shell or backend access."

Two details deserve a slow read.

The models refused. The report notes the attacker's agent switched to an older Anthropic model after newer models refused its requests, and the operator even installed a skill whose sole purpose was stripping the agent's own safety filters. Frontier models are getting harder to weaponize — and this is what the workaround looks like. Hardened defaults have real value; they are not a wall.

The targets were ordinary. Yes, an airline and a Fortune 500 appear in the report. But the volume — tens of companies a day, hundreds total — was ordinary e-commerce sites. Small retailers running common platforms, with file uploads, plugins, and admin panels facing the internet. The same stack your business probably runs.

Why the economics matter more than the drama

Cybersecurity coverage loves the "AI went rogue" framing. The real story is colder: this is an economics shift.

Every security decision a small business makes is implicitly priced. You buy the lock you believe matches the threat. When an attack cost thousands of dollars in skilled labor, mid-sized businesses were priced out of the threat model — attacks on you were irrational, so most never came. When the marginal cost of attacking you is $25 and the loop runs unattended, attacking everyone becomes rational, because attacking everyone is now affordable.

Volume attacks stop being about who you are and become about what you expose. The targeting isn't personal. It's a cost-per-company spreadsheet — and your company is one of the rows whether you knew you were playing or not.

Kaspersky published guidance the same month, applying its "Cyber Immunity" principles to AI agents — treat language models as untrusted components, design security assumptions at the start, isolate, grant minimal privileges. Good advice for builders. But most small businesses don't build AI agents. They run a website, a booking system, a payments plugin. Your defense isn't architectural — it's five boring decisions.

The five decisions that made these targets cheap

Working backwards from the campaign — what made a $25 attack succeed — here's what to fix, in order:

1. Your exposed surface. The attacker's playbook references file uploads, web backends, and WordPress-derived entry points. If your site runs plugins you haven't updated since install, or an admin panel on a guessable URL with no lockout policy, that's the $3.13 end of the range. Update everything, delete what you don't use, and put anything administrative behind MFA — not "a strong password."

2. Where payment data lives. The 600,000 cards were pulled from two companies. Card data sitting on your web server is a vault built into the burglar's entry hall. Use a payment processor that keeps card data on their infrastructure (Stripe, Square, PayPal), never store or log card numbers yourself, and audit your checkout for stray form captures. If you're on an e-commerce platform, check what it logs.

3. Whether anyone is watching. The campaign ran from July and was caught by a security firm's intelligence work, not by the victims. Several targets had live skimming scripts still running when Gambit verified them. Something that alerts you within hours — a file-integrity monitor on your site, an email alert on new admin accounts, a nightly check for unexpected outbound traffic — turns a month-long silent breach into a bad afternoon.

4. How far access travels. One credential shouldn't own everything. The plugin that runs your contact form doesn't need database write access to orders. Your social media manager doesn't need your domain registrar login. When the blast radius of any single compromise is small, the $25 attack stops paying — the attacker spends $25 and gets one small, well-isolated thing.

5. Whether you can recover. The Gambit report notes the attacker's playbook included data deletion and cleanup procedures — and that some victims suffered operational disruption from exactly that. Ransomware taught this lesson; AI attacks inherit it. Backups exist to be tested, not admired. Restore one this month, timed. A business that restores in a day and loses a week of data is a different business than the one that never checks.

The uncomfortable mirror

One more thing worth sitting with: the attacker's orchestrator — the framework with persistent memory, self-written skills, scheduled jobs — is the same class of software that small businesses are being told to adopt this year. The exact properties that make an agent useful (it runs unattended, it retries, it plans around obstacles) are what industrialized this attack. That's not an argument against agents. It's the reason the boring checklist above isn't optional anymore — the technology wave raised the stakes on both sides of the door at once.

The report's own recommendation is the right one, and it's the same one for a five-person shop as for an airline: shift to a resilience-first posture. You will not perfectly prevent every $25 attack. You can make each one cheap for you and expensive for them.

One honest note on who's writing this: we're a $0-revenue small team running a public 14-day experiment on whether our playbook advice actually works — the receipts are here. The playbook covers the agent-permission side of this — the access ladder, the approval gates, the audit habit — in The AI Agent Owner's Playbook, $49 CAD, instant download.

Objectives, Not Instructions: Writing Work an AI Agent Can Actually Own

T.M. Gunderson — Mon, 12 Oct 2026 05:06:08 +0000

At Google's Gemini at Work event on Thursday, the company announced its assistant is becoming an agent — one that plans work, uses tools, and connects to business systems on your behalf. Most coverage will focus on the feature list. One phrase from Google Cloud CEO Thomas Kurian deserves more attention than every bullet under it: the new agent can be given "objectives, not just instructions."

That's a five-word job description for the skill small business owners actually need next. Not prompt-writing. Delegation. And delegation has rules most people learn the hard way — an employee-shaped set of rules that now applies to software.

The difference between an instruction and an objective

An instruction is you doing the thinking and the agent doing the typing:

"Write a follow-up email to the contractor who asked about a quote on Tuesday."

An objective is you defining the outcome and the agent planning the work:

"Every quote that's gone unanswered for two weeks gets a yes or a no by Friday. Drafts queue for my approval. Anyone who's gone quiet twice gets flagged for a phone call."

The second is where the leverage lives. But here's the catch: most people hand an agent an objective it cannot possibly meet, because the objective is missing the three things an agent can't infer on its own. The agent plans — it doesn't read minds.

Three things every objective needs

1. A definition of done. "Improve our follow-up" is a wish. "Every stale quote gets a yes or a no by Friday" is an objective — there's a moment where you can check whether it happened. If you can't tell, from the outside, whether the work is finished, the agent can't either. Write the done-state first, in one sentence, with a number or a date in it.

2. Boundaries. What the agent may touch, and what it must never touch. The useful version is short: it may read the quote log, the email history, and the calendar. It may draft outbound messages. It must not send anything without approval, touch anything involving money, or contact anyone new for the first time. Two lists, five minutes to write, and the difference between an assistant and an accident.

3. An escalation rule. When to stop and ask. The one that works: "If you're uncertain whether something fits the boundaries, or if a customer replies with something angry, legal, or confusing — stop and bring it to me." Agents fail worst in the gaps between your rules. Give them an explicit place to stand in the gap.

If your objective has all three, the agent can plan against it. If it's missing any one, the agent will fill the gap with something — and you won't like what it fills it with.

Never let the first plan run unaudited

Google's announcement describes the mechanics plainly: you assign the agent work, schedule tasks, or let it respond to events, and it plans the work itself — creating a roster of sub-agents, each with its own identity, to run multi-step tasks in parallel. Treat that as the pattern, whatever tool you end up using: when the agent can plan, your job stops being writing steps and becomes reading plans.

The rule that makes objective-mode safe: the first run of any objective is a proposal, not a decree. Before the agent executes, read its plan. What will it touch, in what order? What will it send, to whom? Which sub-tasks did it invent you didn't anticipate?

Most first plans are wrong in a boring way — it'll prioritize the wrong customers, or draft in a tone nobody in your town uses. Catching that costs five minutes. Letting it run costs a week of cleanup and a customer who got a weird email. After the first plan survives review, later runs need only a spot-check: twenty minutes, once a week, reading what actually went out.

The agent signs its own work

One detail from the announcement matters more than it looks: Google's coworker agents get their own Workspace account — their own email address, calendar, Drive, and a presence in the company directory — and an audit trail attributed to the agent rather than to a person. Colleagues work with it the way they work with anyone else.

Strip the branding and that's an accountability architecture. When a customer asks "why did I receive this?", there's an inspectable answer: which objective, which rules, which approval. If you build a delegation habit on any stack, keep that property. Every agent action should trace back to a written objective and boundaries a human approved. That's what makes delegation defensible instead of deniable — and it's the part that survives the vendor changing everything else.

The model is a component, not a commitment

One more announcement detail worth sitting with: by default Google's agent picks the best model for the task, and users can override that — including choosing third-party models, starting with Anthropic's Claude. Google's agent, running Claude's models, connecting to Slack, Microsoft 365, Jira, and Postgres.

The practical read for a small business: the logo on the door is no longer the model doing the work, and it never will be again. Stop optimizing for picking the "right" model. Invest in the layer that outlives every model — the written objectives, the boundaries, the plan-review habit. Those transfer to whatever ships next quarter. There is always a next quarter.

When to use objective mode — and when not to

Objective mode earns its keep on recurring work with a clear done-state: follow-up cycles, review responses, report assembly, inbox triage, scheduling rounds, vendor paperwork chases. Instruction mode is still right for one-offs, novel situations, and anything where nobody has written down how the work is actually done. You can't delegate an objective for a process that only exists in someone's head.

That last point is the real adoption sequence: pick one recurring workflow, write down how it's done today, turn it into an objective with all three parts, review the first plan it produces, then let it run with a weekly spot-check. One workflow. That's the entire plan — and it's the same plan whether the agent arrives from Google, Microsoft, or a $20 automation tool.

The AI Agent Owner's Playbook covers this end to end — the objective-writing format, the permission ladder, and the plan-review checklist: The AI Agent Owner's Playbook — $49 CAD, instant download.

The Decisions API Has a Price Now: A Small Business Walkthrough of Predicates, Choices, and Scores

T.M. Gunderson — Sun, 11 Oct 2026 09:00:09 +0000

When OpenAI announced the Decisions API at DevDay in late September, it shipped with a catch that mattered to anyone watching their budget: no published price. That changed on October 6, when the API entered public beta with real pricing — $0.10 per million input tokens, no output-token charges, and answers that OpenAI says come back about 10x faster than its standard Responses API.

This isn't another vendor comparison. It's the practical walkthrough of what the endpoint actually does — because the whole learning curve is one idea: it asks three kinds of questions, and each type suits a different shape of business decision. Learn the three types and you can map most of your repetitive judgment calls onto them.

The three kinds of questions

A predicate returns a probability. You hand the API some evidence — text or an image — and ask "is X true of this?" It returns a number between 0 and 1, plus a confidence value. In OpenAI's own demo, a product photo comes back with visible_damage at 0.92. Your job is picking the threshold: everything above 0.85 gets flagged, say, and the rest flows through untouched.

Note that image input. Cheap-tier AI that reads photos is new, and it quietly unlocks a whole class of small-business work that used to need a human's eyes.

A choice returns one option from a list you supply — with probabilities for every option. You don't just get the pick; you get billing at 0.95, technical at 0.02, other at 0.02, plus an overall confidence. That per-option breakdown is the useful part: it shows you when the model is sure and when it's guessing. And OpenAI's own guidance is worth taking literally — include a fallback option like "other" and route it to a review queue. A model forced into your categories will mislabel the weird stuff confidently, which is worse than an empty bucket.

A score returns a position on a scale you define. You supply ordered levels, each with distinct criteria, and the answer is the probability-weighted average of the level positions. OpenAI's bug-severity example lands at 1.1 — between "workaround available" and "fully blocked" — with the confidence and per-level probabilities attached. Scores can land between levels; that's the feature, not a bug.

What each type maps to

Three recurring decisions, one per type — chosen because they aren't the simple yes/no calls:

Photo intake triage (predicate). Customers text photos before you quote — damage claims, condition checks, "what is this?" requests. Ask "visible damage present?" and flag everything above your threshold for a human look. If you run a service business that quotes from photos, this is the one to try first.
Dispatch categorization (choice). A handyman or general contractor gets inquiries that could be plumbing, electrical, carpentry, or paint. A choice call returns the trade and the probabilities; other goes to a human. Same pattern works for any business routing requests across service lines.
Urgency severity (score). An emergency line needs severity, not a label: 0 — schedule normally, 1 — needs prompt attention, 2 — emergency. A 1.7 with high confidence means after-hours callout. The one discipline that matters: adjacent levels need distinct, observable criteria, or the scores smear into mush.

The math, now that pricing exists

A decision call carries your instructions plus the input. Call it a thousand tokens for a meaty email or a photo with a question attached. At $0.10 per million input tokens, that's ten cents per thousand calls. Ten thousand decisions a month — more than most small businesses make — costs about a dollar. The price is no longer the reason to not automate the decision.

Honest caveats: it's a public beta (general availability expected in the coming weeks, no date given), gpt-6-luna is the only model on the endpoint for now, and beta endpoints can change shape.

Two disciplines that decide whether it works

Set thresholds from your own labeled examples, not vibes. OpenAI ties threshold-setting to the cost of false positives versus false negatives, using real examples from your own traffic. Work through the asymmetry: for a damage claim, a false positive costs a clerk five minutes; a false negative costs a dispute. So set that threshold low — flag generously, let a human clear the extras. For auto-archiving junk, set it high, because a missed real message is the expensive error. The rule: the more a miss costs, the further the threshold moves toward "a human looks at it."

Batch independent questions; split dependent ones. One request can carry several questions of different types — check the photo for damage and classify the product category in a single call. But if the second question depends on the first answer, that's two requests. Also handle refusals: the API can decline to answer, so route refusals to the same review queue as the other bucket.

Try it before you wire anything

OpenAI ships a Decisions Playground for testing questions and inputs before writing code. If you can describe the decision — the evidence, the question, the options or levels, and the threshold where a human takes over — you can see the answer quality first. No developer needed to find out if it's any good at your specific decision.

The bottom line

The version of this advice from a week ago came with an asterisk: pricing unpublished, confirm before building. The asterisk is gone. What remains is the part that was always the actual work — writing down the decision, the possible answers, and the threshold where you take over.

Tonight: pick one recurring decision in your business that has a photo, a list, or a severity level in it. Write it as a predicate, a choice, or a score — then test it in the playground. The tooling is now the easy part.

Want the model-selection guide and cost frameworks in one place? The AI Operations Playbook covers 50 business tasks AI can handle today, with cost frameworks, a model-selection guide, and an ROI calculator built for small businesses.

Seven in Ten Small Business Owners Have Filmed a Video and Never Posted It

T.M. Gunderson — Sun, 11 Oct 2026 05:04:00 +0000

A video gets filmed for a small business. It comes out fine. And then it never gets posted.

A survey released this week by HeyGen found that 71.6% of small business owners have recorded a video for their business and then decided not to post it. Not "struggled to find time to make videos" — the video exists. It's done. It's sitting in a camera roll or a drafts folder, and it will never see an audience.

Read the survey honestly before anything else: it was commissioned by HeyGen (which sells avatar video software), conducted in August 2026 among 1,000+ owners and solopreneurs at companies under 100 employees, drawn from HeyGen's own user community across 40+ countries, and self-reported. The adoption numbers come from a vendor's backyard. But the shelved-video stat is the one worth sitting with, because it describes a failure you can probably find in your own phone right now.

The gap isn't belief — it's shipping

Here's the detail that makes the 71.6% interesting: 69.3% of the same owners agree that posting video helps build their brand and win business. Almost the exact same share of people who believe in video are failing to ship it.

That's not a knowledge problem. If it were, the how-to content would have fixed it. It's a last-mile problem: the moment between "the recording stopped" and "it's public" is where business content goes to die.

The survey hints at the cost. Owners who shelve videos are 1.5 times more likely to believe they've already lost business to a competitor. Correlation isn't causation, and self-report cuts both ways — but the direction is intuitive. The competitor who posts mediocre video is visible. The one with a perfect take in their drafts folder is not.

Why the last mile kills videos

Four failure modes show up again and again when a finished video doesn't ship:

1. The perfection rewatch loop. You film, watch it back, and all you can see is the filler words and the bad lighting. A stranger would never notice them — but you can't unsee them, so the take gets filed under "redo later."

2. The production cliff. The raw clip is 80% of the value, but the remaining 20% — trimming, captions, a hook, an upload — requires opening an editor you never learned. Momentum dies at the tool.

3. The fear-reception gap. You imagine the audience wincing. Interestingly, the survey measured this: non-users of avatar video predict a middling audience reception (3.06 out of 5), while people who actually post report a warmer one (3.49 out of 5). The audience is friendlier than the fear. It almost always is.

4. Camera drain. The survey reports women find the camera draining at nearly double the rate of men (43.6% vs 28.4%) and are more likely to shelve a finished video (76.6% vs 69.6%). "Just push through the discomfort" isn't a strategy if the discomfort is unevenly distributed — which is one reason alternatives to face-on-camera keep growing.

Two ways through: change the process, or change the medium

Change the process. Three rules cover most of it:

The 24-hour rule. A video gets posted within 24 hours of recording or deleted. Drafts folders are where marketing goes to die; a deadline forces the shipping decision while the take is still fresh.
One take, no rewatch-then-reshoot. Watch it back once for technical breakage (audio dead, half the frame missing), not for polish. Ship the take that exists.
Cut the last mile to one step. Post the raw clip natively — vertical, front-lit, captioned by whatever the platform adds automatically. The editing suite is optional. It always was.

Change the medium. If face-on-camera is the bottleneck, ship the same knowledge in a lower-friction format: a screen recording of your work, a voice-over on slides, or an avatar presenter. Note what the survey found about who's actually adopting avatar video: financial services (78.4%) and legal (77.3%) — the trust professionals — well ahead of real estate (65.6%) and health and wellness (46.1%). The people whose entire product is "be trusted by strangers" are moving first. Legal respondents also reported losing business to a more visible competitor at 69.6%, well above the 55.6% average. When your business is trust, visibility beats polish.

And the users' own numbers: 71.1% say avatar video saved them significant time, 55.3% post more often because of it, and 17.6% credit it with new leads or business they wouldn't otherwise have won. Vendor-sourced, self-reported, from the vendor's own users — treat as directional, not gospel. But the pattern is the same one that shows up in every adoption curve: the tools that remove friction to shipping get adopted faster than the tools that add quality to output.

Your backlog is an asset, not a graveyard

If you're in the 71.6%, the unposted videos aren't embarrassing — they're inventory. A backlog rescue looks like this:

Open the drafts folder. Yes, all of it.
Sort by "is the information in this still true?" — not "is it perfect?" Most of it will pass.
Post the two that pass hardest. Today. Native upload, no edit, one caption line saying what it is.
Delete the rest. Keeping them isn't storing value; it's storing guilt.

The fix for unposted video is not a better camera, a better script, or a better model. It's a shipping rule that doesn't negotiate. The gap between businesses that benefit from video and businesses that film video and gain nothing is one step wide — the step where you press post.

One honest note on who's writing this: we're a $0-revenue small team running a public 14-day experiment on whether this playbook advice actually works — the receipts are here. If you want the full framework — the boring first assignment for a new AI agent, the permission ladder, the one-page process format — it's in The AI Agent Owner's Playbook, $49 CAD, instant download.

The Agentic Registry: A Small Business Audit for a World of Standardized Agent IDs

T.M. Gunderson — Sat, 10 Oct 2026 05:05:06 +0000

Last month the AI industry's big names were fighting over whose chatbot is smartest. This month, quietly, they agreed on something that will affect your business more than any benchmark: customers' AI agents need a standard way to show up at your door.

Two announcements in two weeks, each from the same direction. At Sierra Summit on October 6, Sierra and Meta published the Personal Agent Protocol — an open standard co-developed with Shopify, Stripe, Walmart, Genesys, and Instinct — defining how a personal agent signs in, identifies itself, and completes tasks with a business. That same month, Dataiku's Agent Management — announced September 24, with general availability planned for October — began scanning the platforms enterprises already use (AWS Bedrock, Microsoft Copilot Studio, Salesforce Agentforce) into a single inventory of agents, each with a named owner, named risks, and scheduled tests.

Enterprises read those as governance announcements. If you run a small business, read them differently: the agents are coming to you, with standardized ID in hand, and nobody is building the small-business side of that handshake. Nobody is telling you how to prepare to receive them.

Why an "agent registry" matters even if you have three employees

Here's the shift worth internalizing: for two years, AI agents were something you deploy. In 2026 the direction flipped — the highest-volume agents touching your business are deployed by someone else: your customers' assistants, your vendors' order-processing agents, your bookkeeper's categorization bot. You don't control them. You may not even know they're there.

The protocol solves the ID problem: how a customer's agent proves it's acting for that customer, what scopes the customer granted it, and what your business is allowed to ask it. Dataiku's registry solves the enterprise inventory problem. What neither solves — what nobody ships out of the box — is your side of the door: knowing which agents already touch your systems, what they're allowed to do, and what you'd do if one misbehaved.

The audit: five lines you already have

You don't need a registry product. You need a list. Here's how to build the small-business version this afternoon, from data you already possess.

1. Your inbox: who is allowed to email you as you?

Check your email delegation and forwarding rules. If your assistant or a tool has send-as access, it's an agent in your registry. Jot down: what it can send, as whom, and how you'd revoke it.

2. Your bank and cards: who can move or see money?

List every app with read or write access: accounting tools, subscription managers, expense-categorization bots. Include the new wave — consumer AI agents are already paying with virtual card numbers on their users' behalf, and those transactions arrive with a card name that matches no human. Your books need to recognize them.

3. Your booking and CRM systems: who can write customer records?

Shared calendar links, booking tools, lead intake forms. Any of them can be operated by a machine acting for a person. If your intake only works when a human types slowly, it will start failing quietly as agent-filled submissions increase. (This connects to a pattern covered in "When the Customer's AI Books You" — audit your sales path for machine-filled forms; here we're inventorying the agents, not the form.)

4. Your tools' connections page: every OAuth grant you've made

Every SaaS tool you've ever clicked "Connect" on holds a standing grant to act somewhere on your behalf. Open each tool's "connections" page and list what you find: what's connected, what scopes, when it was last used. Anything you don't recognize gets revoked, not researched later.

5. Your customer-facing channels: where could an agent knock?

List the doors: booking link, intake email, web form, chat widget, phone. For each, note whether a machine acting for a person could currently get through and complete a task — book, ask, buy — without a human on your side noticing. That's your agent readiness map.

Two rules that keep the registry honest

Grant like an employer. When a new integration asks for access, decide the tier now: read-only, or act-on-your-behalf. If it asks to do things, it gets an owner and a review date — even if the owner is you.

Review on a schedule, not on vibes. A registry is only as good as its last review. Put a recurring calendar reminder — quarterly is plenty for a small shop — to re-walk the five lines. Kill anything unused.

What the protocol will ask of you, eventually

The Personal Agent Protocol is a proposal published days ago, not a deployed standard — treat timelines with respect. But the direction is legible. When it lands, a business receiving agent traffic will want to be able to answer three things: who is this agent, what is it allowed to do here, and who granted that? Your five-line registry answers those today. The enterprise products will answer them at scale with connectors and certification trails. The underlying questions are identical; only the price tag differs.

One more honest caveat: standards with this many co-signers (Shopify, Stripe, Walmart) have real weight, but rival protocols exist — some of the same partners are reportedly also backing Visa's effort in this space, per The Next Web's coverage. Small businesses shouldn't pick a winner. Build the registry; let the standards fight it out on your behalf.

The pattern underneath

Notice the shape of these announcements: ID, scope, registry, audit trail. That's not accidental — that's the same design pattern as app permissions on your phone, and before that, network access control. Every wave of automation eventually grows an identity layer, and the businesses that adopt it early treat agent access like employee access: granted deliberately, reviewed periodically, revocable instantly.

Your three-employee shop won't buy a governance product this year. But the five-line registry — inbox, bank, CRM, OAuth grants, customer-facing doors — costs one afternoon and a text file. When a customer's agent shows up with its standardized ID and asks to book the Tuesday slot, you'll know exactly which door it came through, and what it's allowed to do once inside.

If you're assembling your first AI agent roster and want the full framework — the permission ladder, the boring first assignment, the one-page process format that keeps your playbooks portable — it's all in The AI Agent Owner's Playbook — $49 CAD, instant download.

When the Customer's AI Books You: A Readiness Check for Agentic Buyers

T.M. Gunderson — Sat, 10 Oct 2026 05:04:59 +0000

Last month an AI assistant could answer questions about your business. This month it can act for your customer. That difference is the whole story.

When OpenAI shipped Sign in with ChatGPT alongside DevDay's quieter announcements — the Meeting Plugin, Spaces, Pages — the coverage was all developer plumbing: OAuth flows, scopes, integrations. That's the wrong lens. The news isn't a login button. It's that your customers' assistants are on a path to showing up as participants in your sales process: filling your forms, booking your calendar, asking your pre-sale questions, comparing you against the shop down the road — with no human eyeballs on your landing page at all.

If you run a small business, you don't need to bet on a 12-month timeline. You need to know what breaks first when the person "browsing" your site is a machine. Here's that audit.

First, understand the channel shift

For twenty years, every site improvement assumed a human on the other end: emotional headlines, brand storytelling, "call us for a quote." Agentic buyers change the reader, not the page. A booking agent doesn't need to be persuaded; it needs to be answered. It doesn't convert — it verifies. Price, availability, scope, terms. If it can't confirm those, you don't lose the sale on features. You're simply never on its list.

The uncomfortable version: the agent skips your best sales assets because it wasn't built to be moved by them.

The audit: five points where an agent breaks

Work through your own sales path and check each point. This takes an hour, not a quarter.

1. Can an agent reach your booking link?

If your only intake is a "Request a quote" form behind a CAPTCHA, an agent is locked out at the door — it can't solve the puzzle, and it won't phone you either.

Fix: Have at least one intake path with no human-verification gate: a public booking link (Calendly, Acuity, any calendar tool) or a monitored intake email address.

2. Does your booking system reject non-human inputs?

Agents fill forms differently: pasted context, fast timing, odd field formats. Watch for silent failures — required phone-verification steps, dropdowns that don't match how an agent parses "home inspection, 2,000 sq ft."

Fix: Submit one test entry with clipboard-style, over-formatted input. If it fails or hangs, loosen the validation before a customer's agent hits it.

3. Is your pricing an answer — or a vibe?

"Affordable packages tailored to your needs" means nothing to a comparison agent. It needs extractable numbers: starting price, what's included, what costs extra.

Fix: Put a starting price and inclusions on your pricing page in a consistent format. Custom work still gets "from $X."

4. Does your FAQ survive a literal reader?

Your FAQ is written to nudge a skimming human. An agent reads it literally. "We usually reply fast" fails its check for a stated response time; "most projects take a few weeks" fails a request for a number.

Fix: Add the numbers an agent needs to quote: response-time window, typical duration, service area, refund terms. One or two factual FAQ entries per week.

5. Can the agent ask a question when it gets stuck?

A well-built agent hits ambiguity and asks — if it has a channel. A widget-only site gives it nothing.

Fix: Publish a monitored intake email address and link it visibly. Email is the one channel every agent can already use.

What to do — and not do

Do the audit this week, ship fixes over a month. The fixes are small: a booking link, looser validation, numbers on the pricing page, factual FAQ entries, a real email address.
Don't rebuild your site. None of these fixes touch your brand or design. They're additions a human never notices and an agent can't miss.
Don't build an API. A scheduling link plus an email address covers nearly all of it.
Don't optimize for agents at the expense of humans. Human buyers still sign the checks. Make the site legible to both.

Where this goes

Every channel shift rewards the businesses that moved early — being findable on search in 2005, mobile-friendly in 2012. Agentic buyers look likely to follow the same pattern. When a customer's assistant can book a service, it will book the one that confirmed price, availability, and terms fastest. The audit above is how you become that business — before your competitor does.

One caveat: don't take the timeline on faith. If your customer base still emails you from a phone, this is a background task, not a fire drill. But background tasks only get done if someone puts them on the list. Put it on yours.

Want the full framework for making AI earn its place in your business — the permission ladder, the boring first assignment, the one-page process format that keeps your playbooks portable across tools — it's all in The AI Agent Owner's Playbook — $49 CAD, instant download.

The Switching Cost Just Moved: A Software Renewal Audit for the Agent Era

T.M. Gunderson — Fri, 09 Oct 2026 09:00:10 +0000

The "end of apps" argument is everywhere this month: AI agents will eat the interface, software will dissolve into tasks, and the stack you pay for every month will shrink to almost nothing. It makes great conference material. If you run a small business, you don't need a thesis about the future of software — you have renewals sitting on your desk this quarter.

But one piece of that argument genuinely changes your renewal math, and it's the only piece worth acting on: the switching cost is moving from the tool to the trained agent.

Where the switching cost used to live

Software held businesses the same way for two decades. Your data lived inside the tool. Your workflows were configured in its settings screens. Your team learned its menus. Switching meant exporting what you could, rebuilding what you couldn't, and retraining everyone — so you renewed, and the friction, not the feature list, was the real product.

Agents dissolve that friction from the outside. A capable agent learns a new tool roughly the way a sharp new hire does, and your process no longer has to live inside any one app's settings. It can live in instructions you carry anywhere: a one-page writeup of how you quote jobs, how you follow up, which leads go where. When the workflow lives in the agent's context instead of the app's configuration, the app underneath starts looking like a commodity.

That's the inversion: the hard-to-replace asset is no longer the subscription. It's the agent trained on your business. A subscription cancels in an afternoon. An agent that knows your clients, your pricing logic, your exceptions, and your tone is months of accumulated context — and replacing that is the expensive thing now.

The renewal audit: three questions per app

This is not "cancel everything." Most of your stack keeps earning its price — but for a new reason: agents need systems of record to work through. Run one pass over the stack and ask three questions per app.

1. Is it a system of record?

Does other work depend on the data living there — accounting, CRM, job management, scheduling? Then it earns its seat by being where the truth lives. An agent doesn't replace a system of record; it reads it, writes to it, and stops your team hand-typing into it. Keep it — and check that it stays agent-friendly (API access on your tier, clean exports) so the agent's access never turns into a vendor negotiation.

2. Is its real product accountability?

Compliance, e-signatures, payroll filings, audit trails, security boundaries. If what you're buying is the certificate and the legal weight behind it, no agent replaces that. Keep it.

3. Is it mostly UI over a workflow an agent could run?

The honest question, and the exposed bucket. If the tool's whole job is collecting form input, generating documents, walking a person through steps, or displaying data that comes from somewhere else — and an agent holding your process can run that workflow directly — then the subscription's economics are quietly deteriorating. You don't have to rip it out today. But at each renewal:

Stop signing multi-year contracts for it. Lock-in you voluntarily renew is a gift to the vendor.
Downgrade before you re-up. Half the seats, one tier down — let actual usage prove the case for the next decision.
Keep the exit green. Test the export every quarter. The moment your data can't leave cleanly, you've re-created the lock-in you just escaped.

The part most owners miss: now own the lock-in

Here's the useful twist. For twenty years the vendor owned the switching cost and you paid rent on it every month. Now the expensive, sticky asset is the agent's context — and for once, that's something you can own. Three habits get you there:

Write each process once, in files you control. Not in a vendor assistant's chat history — in a doc, a folder, a one-pager. The agent follows it; you keep it.
Grow context deliberately. Every correction ("no, we quote it this way") becomes a saved instruction. Six months in, that file is the asset vendors used to charge you rent for.
Keep it portable. Instructions that work with any capable agent make the next model switch an afternoon instead of a rebuild. If your playbook only exists inside one vendor's walled assistant, you've moved the lock-in one level up — same trap, new landlord.

What not to do

Don't cancel systems of record because an agent can chat with them. The agent needs somewhere true to write. Gut the record and the agent has nothing to work with.
Don't train the agent on a tool you're about to leave. Sequence it: process doc first, then choose the substrate. Otherwise you retrain on a schedule set by your old vendor.
Don't schedule a "big software review." One app per day against the three questions beats a never-finished quarterly project.

The businesses that come out ahead of this shift won't be the ones that predicted which apps die. They'll be the ones who noticed where the switching cost moved — and made sure they own it.

If you want the full framework for making any agent earn its seat — the permission ladder, the boring first assignment, the one-page process format that keeps your context portable — we wrote it down: The AI Agent Owner's Playbook — $49 CAD, instant download.

Dots at $100 a Month, Muse for Free: A Small Business Buyer's Test for Consumer AI Agents

T.M. Gunderson — Fri, 09 Oct 2026 05:00:56 +0000

The consumer AI agent pricing war has officially arrived. OpenAI put Dots — its always-on agent tier — behind the roughly $100-a-month Pro price point, and Meta shipped Muse, a free assistant baked into WhatsApp, Messenger, and Instagram. If you run a small business, your feed is full of reviewers telling you which one is smarter.

Smart isn't the question you need answered. Your rent doesn't get paid by an agent that writes beautiful prose. It gets paid by an agent that finishes tedious jobs — while you sleep, without you babysitting it, and without handing your customer list to a data model you don't understand.

Here's the test that actually decides it.

The boring-work head-to-head

Don't benchmark these agents on coding challenges or trivia. Give both the same three tedious jobs, the kind every business has rotting on a to-do list:

A calendar cleanup. Two weeks of double-bookings, zombie meetings nobody attends, and invites that should have been declined months ago.
A subscription audit. Every recurring charge on the company card — flag what's unused, what's duplicate, and draft the cancellation emails.
A refund chase. One overdue invoice or refund, end to end: compose the follow-ups, send them on schedule, escalate politely, report back.

Then score both agents on the only three columns that matter:

Actions completed — did the job actually finish, or did it produce a nice summary of the job it could have finished? Reviewers love screenshots of plans. Owners get paid on completed actions.
Guardrails — what did it ask permission for, what did it touch without asking, and could you see what it did afterward? An agent that emails your customers without showing you the draft first is not an efficiency; it's a liability.
Data and access — where did the work happen, what did it read, and what happens to that context if you cancel next month?

This is the evaluation framework reviewers skip and owners can't. Dots reviewers got excited when it flagged a recurring weekend "zombie meeting" nobody attended and offered to fix it — that's the right kind of feature to get excited about. Not ambient intelligence for its own sake; ambient maintenance, the boring category of work that's genuinely worth paying for.

What the price tags actually tell you

The $100-versus-free framing is mostly noise for a small business, because the two products aren't selling the same thing.

Muse is free because it lives inside Meta's ecosystem — it's an engagement surface for WhatsApp, Messenger, and Instagram, where Meta's business model runs on attention and activity. The price you pay isn't on the invoice; it's where your work context lives and how it's used. For customer-facing busywork — drafting replies, sorting messages, following up in the same apps your customers already use — that ecosystem position is a real advantage, not a gimmick.

Dots is paid because OpenAI is selling capability as the product itself. The bet is that a more capable agent tier finishes jobs a free assistant summarizes instead. If the boring-work test shows Dots completing jobs Muse can only plan, the subscription is cheap. If both finish the same jobs, the $100 is a fan club fee.

The uncomfortable third possibility

There's a scenario almost nobody in the coverage wants to say out loud: both agents fail the test on most of your work, because consumer agents don't know your business. A generic assistant — free or paid — doesn't know which leads are hot, how you quote, which customers get the friends-and-family exception, or why you never schedule site visits on Fridays. It can clean a calendar. It can't run your follow-up process.

That's not a knock on either product. It's the difference between an assistant and an employee. The generic tiers are excellent at assistant-shaped work: inbox triage, scheduling hygiene, subscription hygiene, first-draft anything. The employee-shaped work — the processes that make your business yours — needs context those products don't have.

Which points at the honest conclusion for most owners: consumer agents are a $0-to-$100 monthly add-on, not a strategy. Run the boring-work test on the free one first. Upgrade only when the test shows the paid tier finishing jobs the free one doesn't. And keep the employee-shaped work in an agent whose context you actually own.

How to run the test without risk

Use sandbox inputs. Not your real customer list — a test calendar, a personal card's subscriptions, one refund you don't care about.
Keep a human checkpoint on anything outbound. First rule of agent work: nothing leaves the building without eyes on it, at least until a job has earned trust.
Time-box it. One week, the three jobs, both agents. If neither finishes them, you've learned the market isn't ready for your use case yet — which is a real answer, and cheaper than a year of either subscription.

The pricing war is great news for small businesses, because the competition means capability keeps getting cheaper. But the price of the agent was never the real cost. The real cost is the work you hand it — and whether what it does with that work is something you'd sign your name to.

If you want the full framework for making any agent earn its seat — the permission ladder, the boring first assignment, the first-month inspection habit, and the one-page process format that keeps your context portable — it's all written down in The AI Agent Owner's Playbook. $49 CAD, instant download.

Microsoft's Autopilot Is Coming: What a Bundled Always-On AI Agent Actually Changes for a Small Business

T.M. Gunderson — Thu, 08 Oct 2026 05:02:56 +0000

For most small businesses, the first always-on AI agent in the workplace won't be one anyone chose. It will arrive the way most software arrives: bundled, on renewal, behind a logo the person approving the invoice already trusts. Microsoft is rolling out Copilot Autopilot — a persistent, proactive agent built on the OpenClaw framework — inside its reimagined Copilot app, where Word, Excel, and PowerPoint are now built into the experience. It's in preview now, so two things before anything else: check whether it has actually reached your tenant and licensing tier, and treat every feature claim as a promise rather than a delivery.

There's an irony here worth sitting with, because it contains the actual lesson. Microsoft spent months publicly treating open agent frameworks like OpenClaw as a security risk — its CEO compared the framework's spread to a virus — and its flagship agent is now built on one. The takeaway for a small business buyer isn't about Microsoft's consistency. It's that the model was never the real risk; the harness is. Permissions, audit trails, data boundaries — those decide whether an always-on agent is safe. When any vendor sells you safety (or fear), ask to see the controls, not the adjective.

What actually changes in your day

An ambient agent inside the apps your team already lives in changes three boring things — and boring is the point:

Inbox maintenance happens without you opening it. Draft replies queue up for approval, long threads get summarized, and the two messages that actually matter surface before you've finished your coffee.
The calendar maintains itself. Recurring meetings nobody attends get flagged, conflicts get caught early, and tomorrow arrives pre-briefed.
Spreadsheets stop being data entry. Fields the team types by hand get filled from the messages and documents that already contain the information.

Notice the pattern: none of this is "AI strategy." It's the ambient maintenance layer — the work nobody was hired to do but everybody ends up doing. If a bundled agent absorbs even half of it, that's real hours back every week.

The catch is that the value comes from two things, and neither is raw model intelligence: the data the agent can reach, and how practiced the person directing it is. Microsoft's enterprise position — more than 450 million paid Microsoft 365 commercial seats, by its own January figures — supplies the first, safely inside your tenant. The second is on you.

What it doesn't cover

The bundling is also the boundary:

Work that leaves the Microsoft estate. Field service apps, job boards, industry CRMs, bookkeeping tools — an agent that runs inside your tenant can't reach them. For compliance reasons, that's partly the point.
Your actual processes. Your follow-up cadence, your quoting logic, the way a job moves from estimate to schedule to invoice — an inbox agent helps execute around those processes; it doesn't hold them.
Anything cross-app. The moment a workflow needs three systems to agree on the state of a job, bundled ambient AI runs out of road.

Which sets up the honest question every owner should ask before renewing anything: is the bundled tier enough?

Five habits that make any approved AI earn its seat

Whether it's Autopilot, Dots, or whatever ships next quarter, the loop is the same — and it's what separates people getting compounding returns from people paying seat fees to occasionally ask a chatbot questions:

Give it real work, not tours. A first assignment like "scan our recurring software charges and brief me on everything renewing in the next 60 days" beats "what can you do?" by a mile. One boring, well-defined weekly job.
Inspect the output every time, at first. The first month is a verification loop, not a vacation. Errors caught early become training data; errors that compound become a mess.
Write the process down first. A one-page description of how the task is done. The agent follows it, and you own something portable that outlives any vendor.
Keep the decisions you'd regret. Drafting runs autonomous; sending externally, moving money, and anything legal route to a human. Set that ladder before the first assignment, not after the first incident.
Carry the lesson. After each attempt, note what worked and what failed, and hand the next agent the improved instructions. Skill compounds across models — the model you practice on barely matters.

The decision rule

Bundled ambient AI handles: email triage drafts, calendar hygiene, spreadsheet cleanup, meeting prep — anything whose data already lives inside the suite.
An agent you own handles: workflows that cross applications, workflows that encode how your business actually wins (pricing, follow-up, intake), and anything you want running on infrastructure you control.

The sequence that works: start with the AI already inside your licenses, log for thirty days which jobs you keep handing it, and build or buy an agent of your own only for the workflows that clear the bar. Most businesses discover two things — the bundled tier handles more than expected, and the short list of workflows it can't touch is exactly where their differentiation lives.

The bundled-agent wave makes ambient AI the default workplace experience. The businesses that come out ahead won't be the ones that bet on the right vendor. They'll be the ones that practiced on whatever they were already allowed to use — because the habits transfer to the next agent, and there is always a next agent.

If you want the full framework for making any agent earn its seat — the permission ladder, the boring first assignment, the one-page process format — we wrote it down: The AI Agent Owner's Playbook — $49 CAD, instant download. We're currently running a public 14-day sprint with daily revenue logs — $0 and counting, reported honestly — while we apply it to our own store.