4 min read
“Agent” has become the default word for anything with AI in it. That is a problem when you are buying, because an agent and an automation cost different amounts, fail in different ways, and need different kinds of supervision. Most of what small businesses need is the cheaper, more predictable one.
The distinction that holds up
The cleanest version comes from Anthropic’s engineering guidance on building with language models. A workflow is a system where the model and its tools are orchestrated through “predefined code paths.” An agent is a system where the model directs its own process — deciding what to do next, and with which tool, as it goes.
The same guidance recommends starting with the simplest solution that works and adding complexity only when it demonstrably improves the result. That is good advice for a software team, and better advice for a business owner with a budget.
Five questions that decide it
| Question | If yes, lean toward | Why |
|---|---|---|
| Can you write the steps down in advance? | Automation | If a new hire could follow a checklist, software can too — reliably and cheaply. |
| Are the inputs mostly the same shape? | Automation | Forms, orders, bookings and invoices are structured. Structure is what automations are good at. |
| Is a wrong action expensive or hard to undo? | Automation + human review | Predictable paths are easier to audit, and a person can approve the risky step. |
| Is the request open-ended, with many valid next steps? | Agent | Research, unusual support cases and multi-tool questions don’t fit a fixed path. |
| Would a person need to read and judge something first? | Automation with an AI step | A language model can read, sort or draft inside a fixed path, without taking the wheel. |
The middle ground is where most of the value is
The most useful pattern for small businesses is neither pure automation nor a free-roaming agent. It is a fixed workflow with one AI step in it and a person at the end.
Take an after-hours inquiry. The workflow is fixed: the form arrives, a record is created, an owner is assigned. One step uses a language model to read the message, classify it — new client, existing client, emergency, spam — and draft a reply in the business’s voice. A person approves the draft in the morning, or a routine one goes out on its own. The path never changes; the model does the reading.
Every marketing automation we build is some combination of four moves: route every lead to an owner, acknowledge it within minutes, follow up automatically until there’s an answer, and report what happened on Monday. None of the four needs an agent. Two of them are better with an AI step.
When an agent earns its place
When the job genuinely can’t be scripted: researching a prospect across several sources before a sales call, answering a customer question that requires looking in the CRM, the order system and the knowledge base, or working through an unusual request with no standard path. Those are real, and agents handle them well — with limits.
The risks that come with autonomy
- Actions, not just words. An agent that can send, book or refund can do the wrong one. Put a person in the loop in front of anything irreversible.
- Prompt injection. Instructions hidden in an email or web page the agent reads can redirect it. OWASP ranks it the top risk for LLM applications in its 2025 list.
- Cost you can’t predict. An agent decides how many steps a task takes. Put a ceiling on it.
- No audit trail by default. Log what it did and why, or you won’t be able to explain a bad outcome to a customer.
A quick way to check a proposal
Ask the vendor what the system decides on its own. If the answer is “nothing — it runs the same steps every time,” it’s an automation, and it should be priced and supported like one. If the answer is a list of decisions, ask who reviews each one.
Sources: Anthropic, Building effective agents, December 2024 · OWASP Gen AI Security Project, LLM01:2025 Prompt Injection.
Definitions: workflow automation, AI agent, human-in-the-loop, prompt injection. Found First builds both — see AI implementation and automation.