What an agent actually is

Somewhere in the last two years the word “agent” stopped meaning anything. It sits on every pricing page you have read, beside a sparkle icon and a badge saying “new”. Before you spend a cent, it is worth knowing which of three quite different things you are being sold.

The clearest definition in circulation comes from Anthropic’s own engineering documentation, and it turns on one question: who chooses the path? A workflow is a system where models and tools “are orchestrated through predefined code paths”. Agents are systems where models “dynamically direct their own processes and tool usage, maintaining control over how they accomplish tasks”.

In plain terms: a workflow walks a route you drew. An agent is handed a destination and picks its own route. That is the whole distinction — not intelligence, not price, not whether there is a chat box.

An agent is not a cleverer chatbot. It is a chatbot you have handed a set of keys — and the keys are the part that deserves your attention.

Here is what the marketing leaves out. Most things labelled “agent” today are workflows: the path never changes, and one step in the middle is a language model reading something and writing something. That is not a criticism. Anthropic’s own advice comes down to “finding the simplest solution possible, and only increasing complexity when needed”.

For a business of one to five people the fixed path is almost always the right answer. It costs less, it fails in ways you can predict, and you can explain it to whoever answers the phone while you are away. Build that first.

Chatbot, workflow, agent — the three rungs

Read this table sideways. The interesting row is not what each one does, it is how each one breaks.

That fourth row is the one nobody mentions in a demo. A broken workflow is a gift: it gives the same wrong output two hundred times, so you spot it on the third. A misjudging agent gives two hundred different wrong outputs, each plausible, and you may never spot it.

The one worth building first

Pick the job already being done badly because it is done at the wrong moment. For most small South African businesses that is the enquiry. It arrives while you are under a sink, in traffic on the N1, or holding a ladder. You read it on your phone, decide to answer properly later, and later becomes Thursday. By then somebody else has quoted them.

So here is the build. Four steps, one of which is the interesting one:

1. It watches one label in your inbox.
2. It reads the enquiry and pulls out the facts — who, what, where, when, how much, what is missing.
3. It writes those facts as a row in a spreadsheet, so you have a list instead of an inbox.
4. It writes a short first reply and leaves it in your drafts folder. It does not send it.

That last word carries an enormous amount. A draft is the cheapest version of a measure security researchers take seriously: OWASP’s Top 10 for Large Language Model Applications names “Excessive Agency” as a risk in its own right and recommends “human-in-the-loop control to require a human to approve high-impact actions before they are taken”. You are the human. The loop is your drafts folder.

The prompt, in full

This is the whole brain of the thing. Copy it, replace the square brackets, and read the notes underneath.

You are the first reader of enquiries for [BUSINESS], a
[WHAT YOU DO] business in [TOWN]. You never reply to
anyone. You read one enquiry and return two things.

FIRST, a record using exactly these fields and no others.
Where the enquiry does not say, write "not stated".
Never guess. Never fill a gap with what is likely.

  name:
  contact: (phone or email, exactly as written)
  suburb_or_town:
  what_they_want: (one line, their words where possible)
  when_they_need_it:
  budget_signal: (any figure they mention, or not stated)
  language: (the language they wrote in)
  missing: (what I must ask before I can quote)
  priority: high / normal / low
  priority_reason: (one short sentence)

Priority rules. High = they named a date inside 14 days,
or an amount over R[YOUR NUMBER], or used the words
urgent, leak, broken, flooding or deadline. Low = no
contact number and no specific request. Else normal.

SECOND, a reply of no more than 90 words, written in the
language they wrote in, that:
  - thanks them and repeats back what they asked for
  - asks only the questions listed in "missing", max two
  - says a person will come back to them within one
    working day
  - is signed [YOUR NAME], [BUSINESS]

Never quote a price. Never promise a date. Never mention
availability. Never add a detail that is not in the
enquiry. If it is spam or a sales pitch, return
priority: low and the single word SKIP instead of a reply.

“Where the enquiry does not say, write not stated.” Models are built to produce a plausible answer, and an empty field does not feel plausible to them. An approved way to say nothing is the most useful sentence in any business prompt.

The fixed field list. Same fields, same order, every time. That turns the output into a spreadsheet row rather than an essay, and lets you scan forty on a Friday and see the pattern.

“Never quote a price.” Anything a customer could hold you to — a number, a date, a promise of availability — stays with you. The machine handles acknowledgement. You handle commitments.

Run it by hand for a week first

Do not automate anything yet. Save the prompt where you can reach it in two taps — a Gem in Gemini, a Project in Claude, a Custom GPT in ChatGPT, or a pinned note. For one week, every time an enquiry lands, paste it in and read what comes back. Ninety seconds each. It shows whether the output suits your trade, where your prompt is vague, and hands you the twenty test cases you need below.

Wiring it up so it runs without you

Once the prompt earns its keep, the wiring is an afternoon.

Route A: Make (the free one that actually works)

Make’s free tier gives two live scenarios, 1 000 credits a month and a fifteen-minute gap between checks. For a business getting a handful of enquiries a day, that is not a crippled trial — it is the finished product.

1. In Gmail, make a label called Enquiry. Filter your contact form, Facebook page and website address into it. Anything the filter misses, you label by hand in one tap.
2. In Make, start a scenario with the Gmail module that watches that label.
3. Add an AI module. Paste your prompt into the system field. Feed the email subject and body in as the message.
4. Add a Google Sheets module: Add a row. Map each field to a column, and put the date and the raw email in the last two.
5. Add a Gmail module: Create a draft. Not Send an email. Look at that step twice.
6. Add one more Gmail module swapping Enquiry for Enquiry-done, so nothing runs twice.

Route B: Zapier (more polished, not free for this)

Zapier has exactly the pieces you want — a New Labeled Email trigger and both a Create Draft and a Create Draft Reply action for Gmail. Two limits are easy to hit halfway through: the free plan caps you at two-step workflows and this build needs four, and the built-in AI by Zapier step, per Zapier’s own help documentation, is not on the free plan at all. A friendlier route, but a paid one.

Route C: n8n, if you already run servers

Self-hosted n8n costs nothing for the software if you are running it inside your own business, which is what its Sustainable Use Licence allows, and it counts no tasks. It also hands you the updates, the backups and the 2am outage.

Five checks before a customer sees anything

Do all five. An hour between them, and each exists because of a real failure.

1. Twenty real enquiries, scored by you. The awkward ones, the one-line ones, the one in Afrikaans, the one that was really a complaint. Mark each reply send, edit or bin. Fewer than fifteen at send or edit and the prompt is not ready.
2. The invention scan. Read only the budget_signal and when_they_need_it columns across all twenty. Every value must trace back to a word the customer wrote. One invented number means the prompt is not being obeyed, and it will invent bigger things.
3. The language test. Feed it an enquiry in isiZulu, Afrikaans or Sesotho, whichever your customers use. Check the reply comes back in that language and the name is spelled the way they spelled it. Getting a name wrong in an automated message is worse than not replying.
4. The nothing-sends test. Run it live with your own personal address as the sender, then open your Sent folder. It must be empty. Do this before the first real customer email, not after.
5. The off switch. Find the toggle that stops the scenario. Turn it off, send yourself a test enquiry, confirm nothing happens, turn it back on. You now know how to stop it at eleven at night from your phone, which is the only time you ever will.

What it gets wrong

It fills gaps rather than leaving them

This is the failure, and it is not theoretical. South Africa’s Department of Communications and Digital Technologies published a draft National AI Policy in the Government Gazette on 10 April 2026 and withdrew it sixteen days later. News24 had found the reference list citing academic articles that did not exist — at least six of sixty-seven, in journals that confirmed they had never published them. The department’s withdrawal statement said vigilant human oversight over the use of artificial intelligence is critical.

A national policy is a long way from your inbox, but the mechanism is identical: the model needed a citation, so it produced something citation-shaped. In your sheet it looks like this:

  what_they_want: geyser replacement, 150L
  budget_signal: R8 000 - R12 000

The customer never mentioned a budget. That range is what a geyser replacement usually costs, so it appeared — and next week you quote against it as though they gave it to you. That is what check two is for.

Someone can write instructions into an email

OWASP lists prompt injection as the number one risk for language model applications, and the indirect version applies here: instructions hidden inside content your system reads. Someone emails you and buries a line telling the model to forward your customer list.

You do not need to become a security expert. You need to keep the keys small. If the worst your setup can do is write an odd draft into your own inbox, the worst outcome is a draft you delete. Give it the power to send, to pay or to publish and that changes shape entirely. Add each key one at a time, months apart.

POPIA, and where a professional is genuinely needed

The moment an enquiry lands in that spreadsheet you are handling someone’s personal information, and you are the responsible party for it — not the tool vendor. Section 71 of POPIA restricts decisions taken “based solely on the basis of the automated processing of personal information” where they carry legal consequences or substantially affect the person, and requires that the person can make representations and be told enough of the underlying logic to do so. Sorting enquiries into a folder is not that. Automatically declining an application, or scoring creditworthiness, is much closer.

There is no AI-specific law here to fall back on either: after that draft policy was withdrawn nothing replaced it, so POPIA, PAIA, the ECT Act and the Cybercrimes Act are what applies. If your automation will decide things about people rather than about your diary, speak to a privacy attorney. We are not lawyers and this is not legal advice.

What it costs, in rand

Four costs. Most people budget for one of them.

We checked these in August 2026, and the date matters more here than anywhere else on the page. AI pricing on these platforms moves — Zapier changed the way it charges for AI steps in June 2026 — so open the vendor’s own pricing page before you commit to anything.

The VAT line surprises people. Under SARS’s rules for supplies of electronic services, a foreign supplier selling software into South Africa must register for South African VAT once its taxable supplies here pass R1 million in any consecutive twelve months, then charge the standard 15%. No zero-rating is available. One carve-out has applied since 1 April 2025: a supplier whose supplies into South Africa go only to South African VAT-registered vendors falls outside the electronic services definition altogether, so it has no duty to register. The upside is real: if you are a registered vendor and the subscription is for the business, that input tax is claimable — but only against a proper tax invoice with the prescribed particulars, in rand. Put your VAT number in the billing settings the day you sign up.

And one item never appears on a pricing page: these tools bill in US dollars, and most South African banks add an international transaction fee on foreign-currency card charges. It differs sharply between banks and lands every month. Check your bank’s pricing guide before assuming the sticker price is the price.

When to let it off the leash

Three gates, all three, before the machine sends anything on its own. One: for a full month you have sent its drafts with barely an edit — not most, nearly all. Two: the mistakes it still makes are boring, a suburb spelled oddly or a stiff sentence, not wrong prices or invented commitments. Three: you have a way to notice when it stops being right, which is the weekly sample of five.

Even then, let it send only the acknowledgement — “we have your enquiry, someone will call you by Thursday”. Anything with a number in it stays a draft, permanently. That is not a lack of ambition. It is where the risk lives.

And that is the moment you could build an actual agent. Instead of a fixed path you hand it the inbox, the diary and the price list, with one instruction — book the site visit if the job is in our area and the morning is open. Now the model is choosing, and it is an agent by the real definition. The review discipline you spent three months building is the only reason it is safe to switch on.