AI Agents That Take Actions, Not Just Answers: Approval Gates, Audit Logs and Spend Caps

You can safely let an AI agent do real work in your business - raise the quote, chase the payment, update the customer record, assemble the monthly report - but only once four controls exist: a named human owner, an approval gate on anything irreversible, an audit log you can still read a month later, and a hard spend cap. Put those four in first and the agent is a junior staff member with a supervisor. Skip them and you have given someone with no memory and no judgement your email account, your accounting system and no timesheet.

What is the difference between an AI chatbot and an AI agent?

A chatbot answers. An agent acts.

If you ask a chatbot to write a payment reminder, you get text on a screen and you decide what to do with it. If you ask an agent, it finds the overdue invoice, writes the reminder, sends it from your company address and notes the follow-up date. Nobody typed anything.

That is the whole change, and it is why the risk profile is different. A wrong answer costs you a minute of reading. A wrong action reaches a customer, a supplier, a bank or a government portal, and you find out about it when someone complains. The technology that made this possible arrived quietly through 2025 and 2026, when the common business tools - email, accounting, your CRM, WhatsApp, your e-commerce store - all gained the ability to be driven by an AI model rather than a person.

Which jobs should a 10 to 20 person company hand over first?

Use four tests. The job should be high volume, low variation, reversible, and already covered by a written rule. If you cannot write the rule down for a new staff member, an agent will not follow it either.

Good first candidates:

• Reading supplier invoices and coding them for the bookkeeper
• Quote follow-ups on day 3 and day 10
• Appointment and delivery reminders
• The weekly overdue debtor list, with a drafted chase message per account
• Collecting staff changes into one payroll summary each month
• First-pass reading of tender and RFQ documents to pull out dates, scope and penalties

Hold back anything that commits a price, signs a document, moves money, or files with a government agency. Those can come later, once the agent has a track record you can point at.

What does an approval gate actually look like?

Sort every action the agent can take into three boxes: automatic, needs approval, never. The middle box is the one that matters.

A working gate has three properties. It is set per action type, not per agent - sending an internal summary is automatic, emailing a client is not. It is fast, because an approval that takes two minutes gets rubber-stamped by the end of the week. And its default when nobody responds is to do nothing, not to proceed.

The failure mode to watch is approval fatigue. A person clearing 200 items a day is not reading them, and you have bought yourself a false sense of supervision. So measure the rejection rate. If a given action has been rejected less than 2% of the time over a full month, promote it to automatic. If it is being rejected more than 10% of the time, the rule is wrong, not the reviewer - fix the instruction rather than keep correcting the output.

Why does the audit log matter more than which AI model you pick?

Because the model will change twice next year and the log is what you will be asked for.

Every action needs seven things recorded: what was done, when, by which agent, on whose authority, what information it used, what it decided and why, and how to undo it. That record is what answers a customer saying they never agreed to that price. It is what satisfies PDPA accountability if the agent touched personal data. It is what a cyber insurer asks for at claim time, and increasingly what an MNC or listed customer asks for in a supplier assessment.

One caution: a log nobody opens is just storage. For the first month, one person should skim it weekly. That is where you find the agent quietly doing something sensible-looking and wrong.

How do you stop an AI agent running up a bill?

Set three ceilings - per task, per day, per month - and make them hard stops rather than alerts. An alert tells you about the money after it is gone.

For a 15-person company running two or three well-scoped agents, expect roughly $50 to $400 a month in AI usage costs. The real exposure is not the price per task, it is a loop: an agent that retries a failing step a few thousand times overnight. A per-day ceiling turns that from a surprise invoice into a message saying the agent stopped.

Cap volume as well as cost. No more than 40 outbound emails an hour. No more than one credit note a day without a person. Volume limits catch the mistakes that are cheap to make and expensive to receive.

Who owns the agent when it goes wrong?

One named person, written into their job description. Not IT, not the vendor, not whoever set it up.

The owner holds four duties: the off switch, the weekly log review, the authority to change the rules, and accountability when the agent gets it wrong. The off switch needs to be reachable from a phone in under a minute, and it needs to have been tested once, deliberately, while nothing was broken.

Add one succession line to the policy: if the owner leaves the company, the agent is reassigned or switched off the same day. An automation still running with nobody responsible for it is the most common way this goes quiet and then goes wrong.

What should an SME do before the end of October?

Q4 is the right window, because January brings payroll and policy changes that will absorb your attention.

1. List the five most repetitive tasks in the company and mark which ones already have a written rule.
2. Pick one. Reversible, internal, boring.
3. Write the three boxes before you build anything: automatic, needs approval, never.
4. Name the owner and set the spend and volume caps on day one, not after the pilot.
5. Run it with every action gated for two weeks, then promote only what the rejection rate earns.

One agent with four controls beats five agents with none. The second one is much easier than the first, and by then you have a pattern worth copying.

Frequently asked questions

Do I need to tell customers that an AI agent handled their enquiry?

There is no blanket rule in Singapore requiring disclosure, but two things do apply. If the agent handles personal data, your PDPA obligations are unchanged - you remain the organisation accountable for it, whoever or whatever processed it. And commercially, being caught concealing it damages trust more than disclosing it ever would. A short line in your privacy notice and a human escalation route on every automated message is the sensible position.

Can an AI agent file our government submissions, such as tax or CPF?

It can prepare them. Let it assemble the figures, flag what is missing and draft the submission, then have a person check and file. Anything carrying a legal declaration should keep a human signature behind it, and any agent working near a Corppass login needs the same access discipline as a staff member. Preparation is where the hours actually go, so you still capture most of the saving.

What does this cost a 10 to 20 person company to set up properly?

For one well-scoped agent with gates, logging and caps, budget a few thousand dollars of setup and a few hundred a month to run, depending on how many systems it must reach. The honest comparison is not against doing nothing - it is against the hours currently spent on the task, and against the cost of the one afternoon a year that task gets forgotten.