Should an AI agent be allowed to talk to your customers?
Every AI draft I've asked for has taken three to seven goes to get right. So I built an AI co-founder with no permission to send anything. Here's why.
Two LinkedIn messages, six drafts. That was last night.
The first was to an investor who’d got in touch a few months back about automation work. The AI I work with wrote a perfectly good reply that opened with an apology for me dropping the thread. Except I hadn’t dropped it, they had. Second draft fixed that. Third draft added the paragraph spacing. The second was to someone who’d mentioned, around the same time, that they might want something rebuilt. First draft was a pitch, three paragraphs on why they should talk to me before anyone wrote code. I wanted one question: is it still planned, or already underway? Second draft was the one question. Third draft added “Thanks, Steve” at the bottom, because apparently I’d never mentioned that I sign everything that way.
Neither message was wrong in a way a spell checker would catch. They were wrong in the ways only I could know. Who left the ball where. How much I wanted to say. How I sign off. That’s the stuff that never makes it into a prompt, because nobody thinks to write it down until the draft gets it wrong.
This morning, four more. Four messages, none over seventy words, nineteen drafts between them. One four-line LinkedIn message took eight. A closing note to someone I’d swapped three emails with took six, and the notes I gave between drafts were things like: that line’s a pitch, that’s a bit forward for me, that implies I know what she’s building and I don’t. Every draft read fine. Every one would’ve cost me something if it had gone.
Honestly, I can’t think of a single email or customer reply I’ve had an AI draft that was right first time. Not one, across a year of using Claude.ai and Claude Code on marketing and CRM work for one of my other businesses. Three goes is normal. Seven isn’t rare. And the gap is almost never the writing. It’s the context I didn’t know I had.
Which is the problem with the thing everyone is deploying right now.
An agent is a model with permission to act
Strip the marketing off and an AI agent is a model that’s been handed tools and allowed to use them until it decides it’s done. Send the email. Book the meeting. Update the record. Reply to the customer. The pitch is autonomy: it does things for you, while you do something else.
But autonomy is exactly the point where the correction loop gets removed. The three-to-seven iterations I need to get a two-paragraph message right don’t disappear when you take me out of the loop. They become the error rate your customers see. The agent apologises to an investor on your behalf. It pitches someone who only wanted a yes or no. It sends the follow-up to a trial user with the tone of a sales rep you’d never hire. And it does it at nine in the morning while you’re in the shower, with your name on it.
I’ve written agents since early last year, and I use coding agents all day. So this isn’t a Luddite position. It’s that the output looking fine tells you very little about whether it’s right, and “right” for anything that lands in a customer’s inbox is defined by things that live in your head.
What I built instead
This week I set up something I’ve been calling Fitzy, a co-founder of sorts across the four businesses I run. It’s built on Claude Code, so by every current definition it’s an agent. It has tools. It runs scripts. It reads my Gmail, my calendar and the analytics for each business.
It is not allowed to send, post, book, reply, schedule, delete or write to anything outside one folder on my laptop.
What’s in that folder is a set of plain files: what each business is betting on, the numbers, every decision with a date and a reason, and a page of rules it has to follow. The model reads all of it fresh every session. It doesn’t remember anything. The files do.
The rules exist because it gets things wrong in ways that look right. On day one it recorded that we’d tried cold email, because it found an outreach script in a code repo. Nobody ever ran it. So now there’s a rule that a thing counts as tried only when I or a number says so. I had to write that down.
What it actually does: it holds the memory so a fresh chat doesn’t re-propose something I killed in September. It pushes back, citing the line I’ve just contradicted. It forces a number and a bet out of me every Monday. And it does the grunt work, pulling the metrics and drafting the message. Memory, opinions, cadence, hands.
The one place it runs unsupervised is a daily email of each business’s numbers, sent to me and only me. Worst case, a wrong number I’ll catch on Monday.
The line is whether a human sees it first
If you’re an owner being sold an agent, the question isn’t whether it’s clever. It’s whether a person sees its output before someone outside your business does.
On the right side of that line: pulling numbers, summarising a transcript, drafting a reply, sorting the inbox, classifying leads. If it’s wrong, you see it, you fix it, you’ve lost a minute. On the wrong side: anything that sends. Customer replies, follow-up sequences, quotes, bookings confirmed on your behalf. If it’s wrong, your customer sees it, and you find out when they tell you, if they tell you.
Most of the agents being sold to small businesses right now sit on the wrong side of that line, and most of the people buying them think they’re on the right side. The honest test is simple. Ask the vendor to show you ten things the agent sent last week, then ask yourself how many you’d have changed. If my own number is any guide, it’s most of them.
I built the thing everyone’s selling, took away its permission to act, and it’s the only version I’d trust with my name on it.
If you’re trying to work out where one of these would actually earn its keep in your business, and where it’d quietly embarrass you, that’s the sort of thing we settle in a day with the AI workflow audit.