Administrative Assistant

The back office of a small firm is hours, expenses, receipts, invoices, mileage and the bills that arrive whether or not anyone is watching for them. It is a few hours a month of work that nobody wants, done badly under deadline, and it is the first thing that breaks when the billable work gets busy.

This is an agent that does it, with no form to fill in and no dashboard to open. It reads the mail, pulls the structure out of what it finds, matches a photographed receipt to a charge already on file, reconciles a card statement line by line, and knows which recurring bills have not turned up when they should have. It runs all day without being asked.

And it has never written a row to the ledger. Not once. The capability does not exist.

Everything above produces a proposal, never an entry. The agent's write tools do exactly one thing each: write a card describing an intended change. There is no tool that reaches the books. The single path from a proposal into the ledger runs through a database function that only fires on a human tap, and the agent has no way to call it.

So the card arrives on a phone and says what it will do in plain words. Two buttons. One tap posts it, one tap throws it away. A correction card shows the old value beside the new one, and refuses to apply if that value moved while the card was sitting there. Anything posted can be undone, because the function stores what undoing it would need before it writes.

The approval step came first and the autonomy was built around it. The agent can be left to work unsupervised precisely because the blast radius of being wrong is one ignored notification. Governance bought the autonomy rather than limiting it, which is the argument we make to clients and the reason this one is worth showing.

Because the alternative is a tool you have to remember to open. Back office work fails at the point of capture: the receipt still in a pocket, the hour worked on a call that never gets logged. Any system requiring a trip to a separate app loses to the fact that nobody makes the trip.

So it lives where the messages already are. Log hours in a sentence. Photograph a receipt. Forward a bill. Ask what is owed and get an answer from the database rather than from a model, because a readout should be a query and the model should not be in the path of a number. There is a private web page for reviewing and exporting the whole ledger, behind single sign-on, and it is the second place you go rather than the first.

Everything above stops at the edge of the books. Since November the assistant can also put a meeting in front of other people. Ask for an invite in a sentence and it drafts one, checks whether the time is free, and mails the guests once the tap comes.

Which invites the obvious objection: an agent that cannot write a row to a database but can email people on our behalf has simply relocated the risk. So the invite runs on the same rail as everything else, and the places where it differs are worth naming.

Missing detail produces a question. No address, no named calendar, and it asks instead of choosing for you, because a sensible default sent to the wrong person has still been sent.

Before the card is drawn, the assistant reads free and busy across every calendar on four connected accounts. It sees whether a slot is taken, never what fills it. A calendar it cannot reach is named on the card and counted as busy, since unknown and free are not the same answer. Where there is a clash the card shows it and the button changes to read Send anyway, so the choice to go ahead is made by a person looking at the conflict.

The tap triggers a second check. Anything that landed in the calendar while the card sat waiting redraws the card and asks again. Tapping twice sends once.

A forwarded email can never produce an invite card. The instructions say so and the code enforces it, which is the difference between a request to a model and a wall. Without that, the guardrail above about mail being data would have a sending capability sitting on the other side of it.

One limit worth stating plainly. A sent invite is not a ledger row, so the undo described earlier cannot reach it, and a meeting gets changed or cancelled in the calendar like any other. Reaching outside the system costs you the ability to take it back. That is why nothing else is allowed out.

The assistant is not a special case. It registers with the same monitoring layer as the rest of this firm's systems: a scheduled probe proves its credentials still work, every run of the mail sweep is logged with its outcome, and a run that stops happening is reported rather than discovered weeks later by its absence.

That last point is the one people skip. A quiet agent looks identical whether it is working perfectly or has been dead since Tuesday, and silence is only a success signal if something else is independently checking for the pulse.