Small Businesses Get More From AI Agents By Adding Guardrails

Key Summary

• AI adoption lags among the smallest businesses: While federal data shows larger firms are increasing their AI usage, businesses with four or fewer employees have flatlined, leaving solo operators to navigate early AI integration without a playbook or security team.
• The risks of uncontrolled automation are high: Small business owners risk costly technical glitches—such as messaging loops burning through funds or unexpected billing details—highlighting the danger of deploying autonomous agents without oversight.
• Simple, low-cost guardrails can prevent disaster: Owners can protect their businesses by implementing basic safeguards like spending limits, clear permissions for moving money or sending customer communications, pre-execution shutdown plans, and asking models to critique automations before launch.

Paul Birrell went looking for a file and found that his business had sent roughly 400,000 emails over three days. An automation he had set up months earlier was looping, and a second loop in his messaging system burned $1,200 of SMS in a single day before he caught the malfunction.

“I don’t have 400,000 customers,” Birrell says.

No security team flagged either issue. Probably because there is no security team.

That is the position a growing number of very small businesses are now in. The Census Bureau counted more than 30 million businesses with no paid employees in 2023, generating nearly $1.8 trillion in revenue, or 6.4% of GDP. Businesses with no payroll are 78.4% of every establishment in the country.

Overall AI use among U.S. businesses sat between 17% and 20% from December through early May, according to the Census Bureau’s Business Trends and Outlook Survey. Firms with at least 250 employees reported 37%. Firms with four or fewer came in under 20%. Use among firms with fewer than 20 employees did not change meaningfully over the six months, while firms with at least 20 employees climbed.

The version of this story you probably read said solo operators were leaping ahead in AI adoption. The federal data says that’s only happening at 20 employees and up. The smallest firms flatlined.

So the early adopters are left without a playbook, meaning the operators brave enough to embrace AI are figuring it out as they go.

Using AI To Catch AI’s Mistakes

Birrell has worked for himself for 34 years. He runs a food and catering delivery service in New Jersey called Delivery Now, a soup subscription business he launched this year and a consulting practice called Decade Strategy. He has about 30 agents and a handful of human contractors.

After the email loop mishap, he stopped trying to prevent mistakes and instead built a way to spot them early. A job now reports his messaging spend every four hours, with an instruction attached to the end of it.

“Put the brakes on it. Stop it,” Birrell says.

The reporting turned up a billing detail he had been paying for but didn’t realize it. His SMS provider counted a message unit at 70 characters, and he had written dozens of system messages assuming it was at 120 or 140. He was paying twice for every send.

Birrell’s monthly AI spend once ran as high as $9,000 and now sits between $1,500 and $2,000, a reduction he attributes to cheaper models. The agent he calls his chief financial officer reconciles his books, checks his banking and sends him a daily expense report. She has the access required to move money.

Birrell says she has never made a transaction, although she could, because he has not given her permission to.

Keep Track of Every Agent You Run

Larger organizations have already learned what can happen when you cede too much control to AI agents. In a January survey of 418 IT and security professionals at organizations of varying size and location, 82% said they had unknown AI agents running in their infrastructure, according to the Cloud Security Alliance.

More than 40% said it happened more than once. Nearly two-thirds reported an agent-related incident over 12 months. Of those, 61% involved data exposure and 35% involved financial loss.

Only 21% had a formal process for shutting an agent down. When an agent exceeded its intended scope, only 11% of organizations automatically blocked the action.

Still, more than two-thirds said they had high confidence in their visibility into agents, in the same survey where more than 80% found one they did not know about.

Every respondent in that research works somewhere with a security function, and they still lost track of their agents.

Luckily, an owner without a security team has a simpler problem. The list of agents is short enough to write by hand. It’s just a matter of making sure the right guardrails are in place.

Some 42% of companies expect agents to act on their own by 2030 and only 5% have critical controls in place today, according to BCG’s 2026 Applied AI Index, which surveyed more than 1,300 executives and senior leaders across more than 20 sectors.

Five Guardrails That Cost Almost Nothing To Set Up

None of these require a security budget or a developer.

Put a spend ceiling and a halt condition on every automation that bills per unit. Most owners find the list is short and that not one item on it has a limit attached. I have written before about AI agent sprawl in small businesses, and the money implications are harder to notice because nothing stops working.

Write down which of your agents can move money, send mail to customers or change a record, and next to each one write whether you actually authorized it. Deciding what to measure first applies here the way it applies to any other spend.

Decide how an agent gets switched off before you switch it on.

Check whether your tools update themselves. AI security researchers found a flaw they named Plugin4Shell in May and informed the companies involved in June. It involves the four most used AI coding agents and an attacker doesn’t need to click anything to exploit it. Plugin auto-update runs in the background and is on by default in Claude Code and Codex. Claude Code fixed it in version 2.1.179 and Codex in 0.146.0. GitHub Copilot has no patch released and Gemini CLI is deprecated with no patch planned.

Then ask the model to argue against the automation before you turn it on. This is the one Birrell rates highest.

“Do you see any pitfalls here? Is there a trap that I could go into?” Is how he puts the question.

Faster Isn’t Always Better

There is one argument against moving fast.

BCG found 44% of the companies it ranks most mature are capturing value from agents today. The firms getting returns are the ones that built the governance first.

The Census numbers complicate the question of urgency, too. If most businesses with four or fewer employees have not started integrating AI, then there’s no real pressure to move this quarter. You’ll be a trailblazer even if you wait a little longer.

Birrell’s own figures cut the same way. The drop in his spending came mostly from cheaper models, not from better discipline, and model pricing is not his to control. He also absorbs a cost he has chosen not to hide. He uses an AI receptionist knowing some callers hang up on it, and he says he does not enjoy admitting that a small amount of lost business is an acceptable trade. But he does have a system that tells him before the money is gone rather than after.

“It can see the flood before the dam breaks and get in there and plug it,” Birrell says.

Connect with an Old National Business banker for more insights to help your business grow.

This article was written by TerDawn DeBoe from Forbes and was legally licensed through the DiveMarketplace by Industry Dive. Please direct all licensing questions to legal@industrydive.com.