“Agent” now appears in software most businesses already pay for. Here is what it means, how it differs from a chatbot or automation, and which of your tasks suit one.
The short answer
An AI agent is AI that can take actions towards a goal, such as checking a calendar, updating a record or sending a message, instead of only answering you. A chatbot answers, and you act on the answer. Fixed automation runs the same steps you set up, every time. An agent chooses some of the steps itself. That makes it useful for messy jobs that cross several tools and vary each time, and riskier around money, customers and records. The practical rule: use the simplest thing that works, save agents for variable tasks, and keep a person approving anything that is hard to undo.
This guide is for owners of small Australian businesses who keep seeing the word “agent” on software they already pay for. It draws on Understanding and using agentic AI, published by the National AI Centre on 26 October 2026 for small and medium businesses that are “considering, buying, implementing or already using agentic AI systems”. We add three things that guide does not: a task-by-task table for common owner jobs, a look at what “agent” means in ChatGPT, Microsoft 365, Claude, Google Workspace and Xero, and a five-question test for your own work.
What is an AI agent, in simple terms?
The National AI Centre (NAIC) defines it this way: “Agentic AI refers to a type of artificial intelligence that can plan, choose steps, use tools and take multiple actions to work towards a goal, with some ability to act on its own.” It adds: “An AI agent is software that uses agentic capabilities to carry out a task.”
Its quick test for any product is to “ask who takes the next step”. If the AI only provides information, content or suggestions and a person decides what happens next, that “is not typically considered agentic AI”. If it can work towards a goal by using tools, making decisions and taking actions, it is likely to be agentic, even if it still asks you to approve some steps. One of its examples: “A café uses an AI agent to track low stock and prepare a supplier order for approval.”
Anthropic, the company behind Claude, draws a similar line in Building effective agents. A workflow follows steps written in advance, with AI doing one or two of them. An agent is given the goal and works out the steps as it goes. Anthropic’s advice to builders applies to buyers too: “we recommend finding the simplest solution possible, and only increasing complexity when needed.” Its reason: “The autonomous nature of agents means higher costs, and the potential for compounding errors.”
AI agent vs chatbot vs automation
| Chatbot or AI assistant | Fixed automation | AI agent | |
|---|---|---|---|
| What it does | Answers questions, drafts text, summarises | Runs the same steps every time a trigger happens | Works towards a goal, choosing steps and using tools as it goes |
| Who decides the next step | You | The rules you set up | The AI, within limits you set |
| Good for | Drafting replies, answering common questions, research summaries | Reminders, copying data between systems, sending a checklist | Messy jobs that cross several tools and vary each time |
| Typical failure | A wrong or made-up answer | Breaks when the input changes, or repeats a bad rule | Takes the wrong action, repeats a mistake across steps, or follows instructions hidden in an email or web page |
| Where you stay in control | Read before you send | Test the rules, watch the error log | Limit access, approve actions that are hard to undo, keep a log, know how to stop it |
One commenter who uses both wrote, in an r/automation thread on replacing parts of a workflow with AI: “Rule-based stuff is still way more reliable for anything predictable, like moving data, triggering emails, updating fields. I wouldn’t swap that out.” Whichever you use, clear instructions matter. Our guide on how to prompt AI covers habits that carry over to an agent’s standing instructions.
Why the word “agent” doesn’t tell you much
Vendors use “agent” for very different things. Microsoft’s Copilot Studio sorts agents into what it calls “harnesses”, meaning the engine an agent runs on, including “the standard harness for rule-based, predictable conversations” (Microsoft Learn). Microsoft still calls that kind an agent.
Xero shows the other half of the pattern. Its media releases call JAX an “AI financial superagent” (Xero, September 2025) on “Xero’s agentic platform” (Xero, July 2026). Its Australian JAX product page does not use the word “agent”.
Gartner’s term for rebranding chatbots and assistants as agents when they cannot do much on their own is “agent washing”. Reuters reported in June 2025 that Gartner expects “More than 40% of agentic artificial intelligence projects will be canceled by the end of 2027” and estimated “only about 130 of the thousands of agentic AI vendors are real” (Reuters via The Star).
You may already have agents in tools you pay for
The NAIC notes that agentic capability “may be built into software you already use, even if it’s not labelled as an AI agent”. The table reports what each vendor says, not a test we ran, with prices only where an Australian vendor page confirms them. If you are choosing between the two biggest names, our ChatGPT Business vs Microsoft Copilot comparison covers prices and data handling.
| Product | What the vendor calls an agent | What it can act on | How it asks before acting | Plan notes |
|---|---|---|---|---|
| ChatGPT Work (OpenAI) | OpenAI says “Work is an agent designed for longer, multi-step work and finished deliverables” (OpenAI help). It replaced ChatGPT agent mode, which OpenAI says “is no longer available” (OpenAI help). | Connected apps such as Gmail and Slack, your files, a cloud browser that can sign in to websites, and tasks that repeat on a schedule or start when a new email arrives. In the desktop app it can also use a built-in browser and, with your permission, files on your computer | OpenAI says ChatGPT “is designed to request confirmation before actions that could be hard to reverse or create a financial, legal, account, or other real-world commitment, such as confirming a booking or making a payment” (OpenAI help). By default it also asks before it opens a new website. It pauses when you need to sign in, and you can take over its browser or stop the task. | Plus, Pro, Business, Enterprise and Edu get Work on web, mobile and desktop. Free and Go get limited access in the desktop app only (OpenAI). Every Business seat includes it. There is no fixed message count. Longer tasks use more of your allowance, and you can buy credits for more. |
| Microsoft Copilot agents and Copilot Studio | Anything from “simple prompt-and-response agents to more advanced, fully autonomous agents” (Microsoft), including the rule-based “standard harness” agents described above. | Teams, Copilot Chat, websites, connectors, files | Copilot Studio workflows include “built-in testing and human-in-the-loop controls” (Microsoft Learn). | Agents that only use public web content are included with Copilot Chat. Agents that read your organisation’s own files, such as SharePoint, are billed pay-as-you-go (Microsoft). Copilot Studio prepaid packs: “25,000 Copilot Credits each, priced at AU$299.30/pack/month”, before GST (Microsoft Australia). |
| Claude Cowork (Anthropic) | Anthropic says Cowork uses “the same agentic architecture that powers Claude Code” (Anthropic). | Files and folders you grant, connected tools, a browser built into the Claude desktop app or your own Chrome browser | You choose a mode. Manual asks before each action. Auto, the default on Pro, Max, Ultra and Team in the new Claude experience, keeps working and blocks actions Claude judges unsafe. In every mode, “Claude requires your explicit permission before permanently deleting any files.” Anthropic’s safety page says to switch to manual approval when mistakes would be hard to undo, like sending messages or making purchases. | “Claude Cowork is available on paid plans (Pro, Max, Ultra, Team, and Enterprise)”. It runs on Anthropic’s servers and works on desktop, web and mobile, with web and mobile in beta on Team and switched on by the owner on Enterprise. |
| Google Workspace Studio | Google calls it the place to create and share AI agents that automate work in Workspace, with no coding needed (Google). | Gmail, Drive and Sheets, plus Asana, Jira, Mailchimp, Salesforce and webhooks | Google’s launch post does not say. Admins can switch Studio on or off for teams. | Listed for Business Starter, Standard and Plus. Google says it reached all Workspace domains by 19 March 2026. |
| Xero JAX | “AI financial superagent” in media releases, though the Australian JAX page does not use “agent”. | Bank reconciliation, overdue invoice follow-ups, bill checks (some features announced as coming soon) | “JAX automatically reconciles transactions when it’s highly confident they match.” “If in doubt, JAX suggests a match but leaves the transaction for you to reconcile manually” (Xero). | JAX chat is included at no extra charge for now. Automatic reconciliation is on Grow plans and above, and an optional add-on for Ignite. |
In a January 2025 r/microsoft_365_copilot thread on practical uses for Copilot agents, one commenter wrote: “We use it largely as an internal search engine.” They added: “the bot isn’t wrong, your documentation is wrong”.
Xero’s AI page says “JAX reconciles your transactions automatically at 97% accuracy”. Comments on Reddit are more mixed. In an r/xero thread in July 2026, one user wrote: “I had to turn off the bank matching thing as it kept reconciling the wrong things.” In a November 2025 r/AusFinance thread asking Australian small business owners about AI for receipts, one commenter replied: “Xero has an OCR / ‘AI’ mode for receipts. It works about 50% of the time, the other half I end up doing manually.” Neither comment is a measurement, and the second is about receipt capture rather than bank matching. Both are reminders to spot-check automatic work for your first few months.
Ten common tasks: chatbot, fixed automation or agent
This is our recommendation for a typical small business, based on the guidance cited.
| Task | Best fit | What can go wrong | Where a human approves |
|---|---|---|---|
| Answering common questions (hours, service area, what you do) | A chatbot or AI receptionist that answers only from information you give it | It states something untrue, and you are responsible for it | You write and update the source answers. Complaints, refunds and quotes outside your rules go to a person |
| First reply to a new enquiry email | Fixed automation for the instant acknowledgement, plus an AI draft of the full reply | Made-up prices, dates or promises in the draft | A person reads the draft first, using our two-minute check for AI replies |
| Quote follow-up when there is no reply | Fixed automation (“no reply in 3 days, send reminder”), with an optional AI-written nudge | Chasing someone who already accepted, declined or called you | Approve the wording once. Read any personalised AI version before it goes |
| Chasing overdue invoices | Fixed reminders in your accounting software | Chasing an invoice that is paid, disputed or on a payment plan | Approve the schedule and wording. Take disputed accounts out of the automatic run |
| Booking and rescheduling appointments | Booking system rules. An agent only if requests arrive in messy forms across email, SMS and phone | Double bookings, wrong times, bookings outside your hours | Exceptions. The NAIC notes a salon booking agent may not need payroll, customer payment details or private staff records |
| Collecting documents from clients | A fixed checklist and reminders. AI can check what is missing, read-only | Chasing documents already received, or sending files to the wrong person | A person confirms a file is complete before work starts |
| Bank reconciliation and categorising transactions | The automatic matching built into your accounting software, if you have it (Xero calls it JAX). The data is structured and the software can say how confident it is | Wrong matches. If Xero’s claimed 97% held, 400 transactions a month would leave about 12 to catch | Review suggestions and spot-check automatic matches before each BAS |
| Paying supplier bills | Fixed automation for scheduling. Never let AI change bank details or release payments | Fake invoices with altered payee details, or instructions hidden in an email | A person approves every payment and every change to a supplier’s bank details |
| Refunds and complaints | A person. AI can summarise the history and draft a reply | Promising or refusing something you should not | A person decides and sends |
| Researching suppliers or comparing options online | ChatGPT Work or Claude Cowork, for research only. It has to visit many sites and decide where to look next | Hidden instructions on web pages, outdated information, logging in where it shouldn’t | Read the results yourself. Do any sign-in yourself, and check every form or purchase before it goes through |
Notice how few rows end in “agent”. Apart from features already built into your accounting software, the jobs where an agent earns its place have unstructured input: requests that arrive in different shapes, and research across sites you cannot list in advance. Everything else is cheaper and more predictable as a chatbot or a fixed rule.
What can go wrong
The NAIC guide puts the shift in one line: “With agentic AI, the risk is not just what the AI agent says. It is what it can see, change, send or do.”
Mistakes repeat across steps
A chatbot’s mistake is one wrong sentence you read before acting. An agent’s mistake can carry into the next step and the one after. In Anthropic’s 2025 experiment Project Vend, Claude ran a small shop in Anthropic’s office for about a month. It gave away discount codes, sold items below cost and told customers to pay into an account it had made up. Anthropic’s verdict on its shopkeeper: “we would not hire Claudius.” The model has moved on since. The lesson about letting an agent discount and price without a check has not.
Instructions hidden in emails and web pages
This is called prompt injection. OpenAI wrote in December 2025: “Prompt injection, much like scams and social engineering on the web, is unlikely to ever be fully ‘solved’” (OpenAI). Its hypothetical example is the one to picture: an email crafted to trick the agent into ignoring your request and forwarding sensitive tax documents to the attacker. In August 2025 Anthropic reported that deliberate attacks on its browser agent succeeded 23.6% of the time without its safety measures, and 11.2% with them (Anthropic). In a tougher test in November 2025, Anthropic reported about 1% for its newer model and safeguards, and said that this “still represents meaningful risk. No browser agent is immune to prompt injection” (Anthropic). That is why both companies say their agents ask before high-risk steps such as purchases and payments.
For supplier bills, Scamwatch warns that small businesses receive “an invoice you were expecting from a client or supplier, but with altered payee and contact details” (Scamwatch). A person who knows the supplier has a chance of noticing, especially if they phone to check. An agent working through the inbox has no such instinct.
Bills that grow while you are not looking
The NAIC guide warns: “AI agents can be more costly than expected if they perform many steps, use multiple tools or continue working in the background.” ChatGPT Work has no fixed message count. OpenAI says “A longer task can use more of your allowance than a short task” (OpenAI help). When the allowance runs out, you can wait for it to reset, upgrade or buy credits (OpenAI help). Copilot Studio runs on credits, and some agent types start using credits while you are still building them (Microsoft Learn). If a tool bills per action and runs in the background, read its invoice every month.
You stay responsible
In 2024 a Canadian tribunal ordered Air Canada to pay a customer damages after its website chatbot wrongly said a bereavement discount could be claimed after booking. The tribunal said: “It should be obvious to Air Canada that it is responsible for all the information on its website. It makes no difference whether the information comes from a static page or a chatbot” (Moffatt v. Air Canada, 2024 BCCRT 149). That is a Canadian small claims decision about a chatbot, not Australian law. Australian guidance takes the same line on accountability, though. The NAIC’s Guidance for AI Adoption says of any AI system: “your organisation is ultimately accountable for how and where AI is used”.
Test your own task in five questions
- Does it follow the same steps every time? If yes, plain automation is cheaper, more predictable and easier to fix. You probably do not need an agent.
- Is the result just words a person will use? A draft, a summary, an answer. That is a chatbot or assistant job, and you check it before it goes anywhere.
- Does it need to work across several tools, with inputs that look different each time? This is where an agent can help.
- What is the worst thing it could do with the access it needs? If the answer involves money, customers, personal information or deleting records, follow the NAIC’s advice: “Start with draft-only or read-only access.” Let it prepare work, suggest next steps or identify issues before it can change records, send messages, place orders or trigger workflows.
- Can you see what it did, and stop or undo it? If not, do not switch it on yet.
The NAIC guide packages the same thinking as four checks: Access, People, Visibility and Stop. Its rule of thumb: “treat an AI agent like a new staff member or contractor.” You would not hand a new contractor the bank login on day one.
If your answers show that the process itself is the problem, the fix may not be software. Our guide on whether to automate, fix the process or hire works through that choice.
What to ask a vendor who says “agent”
The NAIC guide advises owners to “Ask questions and request clear answers before purchasing, enabling or expanding the use of an agentic AI product.” This is a shortened, reworded version of its list that you can paste into an email. We added the first question.
1. What does the “agent” decide by itself, and what steps did you set up in advance?
2. Can you show me a log of a real run, start to finish?
3. What systems and information can it access? Can we limit that to one task?
4. What can it do without asking us first: send messages, update records, place orders, make payments?
5. Can we choose which actions need our approval?
6. How is it billed (per user, per task, per credit or per message), and what stops costs climbing when it runs in the background?
7. Where is our data stored, and is it used to train the AI?
8. How do we pause it, remove its access and undo what it changed?
9. What does it do when it is unsure, or when a connected tool fails?
10. How will we know when the AI model or product changes?
11. Who is responsible if it makes a mistake?
Australian rules and guidance that still apply
- Privacy. The OAIC recommends that organisations “do not enter personal information, and particularly sensitive information, into publicly available generative AI tools” (OAIC). An agent with inbox access reads personal information whether or not you paste it in, so check which tool, on which plan, with which data settings.
- Automated decisions. From 10 December 2026, businesses covered by the Privacy Act must say in their privacy policy when a computer program uses personal information to make, or substantially help make, decisions that could significantly affect a person’s rights or interests (OAIC). Most businesses with turnover of $3 million or less are not covered, but some are, such as health providers. If yours is covered and an agent decides who gets a refund or a booking, check whether this applies. Our guide to automated decisions in your privacy policy covers what to write.
- Security. The Australian Cyber Security Centre’s May 2026 guidance on agentic AI is aimed at larger organisations, but one line suits any business: “Prevent agents from autonomously executing high-impact actions or outputs without prior human approval” (ACSC).
A sensible next step
Pick the task from the table that costs you the most time and run it through the five questions. If it comes out as “chatbot” or “fixed automation”, you have saved yourself an agent subscription. If it comes out as “agent”, start the way the NAIC suggests: draft-only or read-only, with a person approving each action, for long enough to see a month of logs. Before you switch anything on, our automation readiness checklist walks through the one-page brief to prepare.
If you would rather have someone build the draft-and-approve version, with the checks and handovers designed in, that is the kind of workflow automation AppliedAgents builds for Australian businesses.
Sources
Australian guidance:
- National AI Centre, Understanding and using agentic AI (26 October 2026; PDF) and Guidance for AI Adoption: Foundations (5 May 2026)
- Australian Cyber Security Centre, Careful adoption of agentic AI services (1 May 2026)
- Office of the Australian Information Commissioner, Guidance on privacy and the use of commercially available AI products and New resources on transparency for use of AI and automated decision-making (30 September 2026)
- Scamwatch (ACCC), Protect your small business from scams
Vendor documentation:
- Anthropic, Building effective agents (December 2024), Piloting Claude in Chrome (August 2025), Mitigating the risk of prompt injections in browser use (November 2025), Project Vend, Get started with Claude Cowork and Use Claude Cowork safely
- OpenAI, ChatGPT Work and Codex, ChatGPT Work, Using cloud browser in ChatGPT, ChatGPT Business models and limits, Understanding ChatGPT and Codex usage limits, ChatGPT agent (now a retirement notice) and Continuously hardening ChatGPT Atlas against prompt injection (December 2025)
- Microsoft, Copilot Studio overview, Agents overview, Purchase and manage agents in Copilot Chat, Overview of usage-based billing and Copilot Studio pricing (Australia)
- Google, Now available: Create AI agents to automate work with Google Workspace Studio
- Xero, JAX, Reconcile bank transactions, AI in accounting, and media releases from September 2025 and July 2026
Cases, research and discussion:
- Civil Resolution Tribunal of British Columbia, Moffatt v. Air Canada, 2024 BCCRT 149 (14 February 2024)
- Reuters via The Star, Over 40% of agentic AI projects will be scrapped by 2027, Gartner says (25 June 2025)
- On Reddit: threads in r/automation, r/microsoft_365_copilot, r/xero and r/AusFinance
This article is general information, not legal or financial advice. Product features and prices were checked on 8 November 2026, and other sources on 2 November 2026. Agent features change monthly, so confirm current behaviour and plan terms in your own account. The ten-task table is our recommendation based on the guidance cited, not a report of client results, and we have not tested the products described.
Practical thinking on AI, automation and the work behind a business.
