What an AI agent actually is, and what it is not
An AI agent is not a chatbot with a friendlier tone. A chatbot answers questions inside a box you control. An agent takes a goal, decides the steps, and then acts — it reads files, calls other software, sends messages, updates records. That difference is the whole story. An agent that can act can also act wrongly, repeatedly, and at speed.
For a Hong Kong SME with a small team, the appeal is obvious: work happens after hours, nobody has to remember to do it, and the marginal cost of one more task is close to zero. The risk is equally obvious once you say it out loud: you are handing a task to something that will not stop and ask for permission unless you built that in.
The four questions to ask before you hand over any task
1. Is the task repetitive and rule-shaped?
Agents do well where the same inputs lead to roughly the same outputs. Drafting a weekly stock summary from a spreadsheet, pulling new enquiries into a CRM, tagging support emails by topic, generating a first-pass quotation from a rate card. These are good candidates.
Agents do badly where judgement, relationship or liability live. Pricing a custom job for a long-standing client, replying to a complaint, deciding whether to extend credit, anything that touches a contract. If a wrong answer would cost you a customer or a legal position, keep a human in the loop.
2. What happens when it is wrong?
Write down the worst realistic failure. Then ask: would I notice within a day? If the answer is no, do not automate it yet. A wrong internal draft is cheap. A wrong invoice sent to forty customers is not.
3. Does it need write access?
Read access is a different risk category from write access. An agent that can read your inbox is a privacy question. An agent that can send from your inbox is a reputational one. Start with read-only, and add write permissions one at a time, with a named person responsible for each.
4. Who owns the output?
If an agent books a meeting at the wrong time, someone still has to fix it. Decide in advance whose job that is. Automation without an owner becomes nobody's job, which is how small problems become weekly ones.
A realistic starting sequence
- Pick one task, not a department. Choose something that happens at least weekly and takes under an hour. Anything bigger is a project, not a pilot.
- Run it manually for two weeks and log it. You need a record of what the correct output looks like before you can judge whether the agent is right.
- Run the agent in shadow mode. It produces the output; a human still does the real work. Compare for a fortnight. This is the step most SMEs skip, and it is the only step that tells you anything.
- Give it a narrow permission set. One tool, one folder, one mailbox. Not the whole drive.
- Set a kill switch and a review date. If nobody has checked the agent's output for a month, it is not automated, it is unsupervised.
Where the money actually goes
The subscription is rarely the expensive part. The cost sits in setup, in the human review time you still need, and in the maintenance when an upstream tool changes its interface and the agent silently starts failing. Budget for all three, and be suspicious of any quote that only mentions a monthly fee. If you want a second opinion on what a build should reasonably cost, our pricing page sets out how we structure these projects.
Security is not a separate project
An agent with credentials is a new account on your network, and it needs the same discipline as a staff account: least privilege, a log of what it did, and a way to revoke access the day you stop using it. Hong Kong's own cyber defence drills now routinely include private-sector defenders, which tells you where the threat modelling is heading. If you would not give a new hire the keys to every system on day one, do not give them to an agent either.
Two habits cover most of the risk. First, keep a written list of every agent, what it can reach, and who approved it. Second, review that list quarterly and delete anything nobody has used. Orphaned agents with live credentials are one of the quietest ways an SME gets exposed.
When it is genuinely not worth it
- Your volume is low. If a task happens twice a month, the setup cost will never repay itself.
- The process is not written down. An agent cannot follow a rule that only exists in someone's head.
- You cannot describe a correct output in one sentence. That means the task needs judgement, and judgement is the last thing to automate.
- Nobody has time to review the output. Unreviewed automation is just a faster way to make the same mistake.
Automation does not remove work. It moves work to the review step, and the review step is where the value is either captured or lost.
Summary
AI agents are worth trying when the task is repetitive, the correct output is easy to describe, the failure is cheap and visible, and someone owns the review. They are a waste of money when volume is low, the process is undocumented, or the output needs judgement you cannot specify. Start with one task in shadow mode, grant the narrowest permissions that work, keep a written register of every agent and its access, and set a review date before you switch it on. If you are planning a build and want to talk through scope and cost first, get in touch and we will tell you honestly whether the task is worth automating.