# An SME run on AI agents > We rebuilt an SME to run on security-bound AI agents across the whole business. Agents manage the website and marketing, sort the inbox and files, and handle invoices, receipts and offers. ## The assistant that never got hired The owner of a small company was drowning in repetitive work and had decided to hire an assistant to take it off their plate. The brief we got was smaller than that. They wanted help using AI more. We asked a different question in the first meeting. What if the assistant were a set of agents, and what if they took the menial work off everyone, not just the owner? That set the constraints. An [SME](https://single-market-economy.ec.europa.eu/smes/sme-fundamentals/sme-definition_en "Small and medium-sized enterprise, in the EU sense, meaning under 250 staff. This one is much smaller than that.") has no IT team and should not need one. Whatever we built had to run on almost no infrastructure, be operated by anyone who can use a computer, and cost less than the assistant it replaced. A full workflow engine was out of the question. So was anything a developer would have to babysit. A few days following the company's operations were enough to map the tasks people did over and over. Meanwhile we worked out what the simplest possible system would look like. ## No single provider One requirement we set ourselves before the client did. Nobody should be locked to one AI provider. The field moves too fast to bet a company's operations on one model, and the right answer to "which model" changes every few months. The client should be on the best model available and able to switch whenever they like. Most of what followed comes from that decision. Around this time the providers had introduced [skills](https://agentskills.io/ "An open format for the instructions an AI agent loads when a task calls for them. A folder of markdown files, nothing more."), a way of handing an agent a written procedure for a task. Written tightly, a skill walks the agent along a tightrope. Written loosely, it lets the agent cross an open field and make its own calls. Either way, a skill is not magic. It is a prompt in plain language in a markdown file, and a set of skills is a folder of them. That was the whole architecture. A company knowledge base as well-formed markdown, a set of skills as markdown, hosted anywhere. Give an agent the knowledge and the skills and it operates as an employee who knows the company and has a precise procedure for every job. It seemed almost too simple. ## Keeping the files honest Anyone who has worked with AI knows what happens to a folder of instructions left in its care. It [rots](https://alexop.dev/posts/stop-bloating-your-claude-md-progressive-disclosure-ai-coding-tools/ "A developer's account of how an agent's instruction file swells by one rule per mistake until it eats half the context before any work starts."). The agent adds rules on top of rules, restates what is already there and writes instructions in capitals. We tested it. Too strict, with a wall of "never do X" and "always do Z", and the agent freezes and asks permission for everything. Too loose and it looks for [dangerous ways around a block](https://www.theregister.com/2025/07/21/replit_saastr_vibe_coding_incident/ "The Replit incident of July 2025. Told to freeze all changes, the agent kept going, wiped a production database and then admitted to a catastrophic error of judgement."). Too verbose and its context fills with noise. Too specific and it gets stuck the moment the situation differs from the script. The answer was a small number of meta skills, written by hand and with great care. A skill for editing the knowledge base, so every addition lands in the right shape. A skill for writing new skills. A skill that audits the whole structure for duplicates, contradictions and dead weight, run on a schedule. With those in place, the agent could build the rest of its own toolkit, and we could check its work against rules it had not written. ## Everything in Git The files needed a home, and the obvious one was [Git](https://git-scm.com/ "The version control system behind most of the world's software, here holding a company's knowledge and skills rather than code."). Full history of every change to every skill and every fact about the company. No lock-in to any provider's platform. Running on Claude? Point it at the repository through a [connector](https://support.claude.com/en/articles/11176164-use-connectors-to-extend-claude-s-capabilities "How Claude reads an outside system such as a Git host, so the skills live in the repository and not on the provider's platform."). Running on ChatGPT? Point it at the same repository. Self-hosting a model? Same again. The company's operating manual lives in one place, and the agent reading it is interchangeable. ## Where the agent stops An agent that reads email, holds company data and has the open internet in front of it is a liability unless it has hard edges. We drew them the same way we would for a person. The agent has its own seat on the AI provider and its own account in the client's workspace, and that account is bound by [workspace policy](https://support.google.com/a/answer/2640542 "A Google Workspace rule that stops a given account from sending mail or sharing files outside the organisation. Microsoft 365 has the equivalent.") so it cannot send mail or share a file outside the company. Not an instruction the agent could talk itself out of. The account cannot do it. Inbound is filtered too. Mail rules catch the obvious [prompt injection](https://www.varonis.com/blog/echoleak "EchoLeak, found in 2025. One email with hidden instructions was enough to make Microsoft 365 Copilot hand company data to an outside server, without the recipient opening it.") patterns, the "ignore previous instructions" and "this is a system prompt" family, before the agent sees them. And the agent is told to treat everything it reads as data, never as an instruction, which held up against our own attempts to break it. When a person is driving, the same rule applies as for any tool. The agent is a power tool rather than a screwdriver, and the person holding it is responsible for where it points. ## What the agents do now We started with the tasks that ate the most time. - **The contact inbox.** Spam dropped, each mail labelled and forwarded to the right person. Nobody watches the inbox any more, and the mails that matter reach the right people on time. - **Receipts and invoices.** Forward one to the agent, or drop it in the chat, and it files it with the accounting firm, checks for duplicates, fills in the details and asks when the reason for a purchase is unclear. - **Month end.** The reconciliation, chasing missing receipts, matching every payment on the accounts to an invoice. - **Meetings.** Notes drafted, circulated and agreed, the actions pulled out and assigned, and followed up on. - **Quotes and invoices.** A quote priced from the company's history of past quotes in minutes, where it used to take an hour of gathering. An invoice drafted on the company template. - **The website.** Changes made without calling a developer. Beyond the set tasks it works as a knowledgeable colleague. A spreadsheet of last month's sales. An email in the company's voice. A pitch deck for a hard customer, on brand. ## What it cost, and what it saved Each employee has a seat on the AI provider and so does the agent. That is the whole bill. No API metering running into thousands a month, no automation platform, no developer on retainer. Nothing to maintain beyond the periodic audit the agent runs on itself, and when something does go wrong, we are a message away. The owner got roughly a day a week back. Almost every part of the company shed hours. The assistant the company was about to hire, with the weeks of onboarding and the salary that came with it, became a set of skills the agent writes for itself. The work continues. We keep finding tasks to hand over, and we are watching how the knowledge base holds up as it grows. Tools like [Zapier](https://zapier.com/ "A hosted automation platform that wires apps together with triggers and actions.") and [Make](https://www.make.com/ "A visual automation builder in the same family as Zapier.") have their place in larger companies. For an SME, a folder of markdown, a Git repository and a well-fenced agent turned out to be enough, and better than we had hoped. We wanted to write this one up early. It was too interesting a problem to sit on.