AI Agents for Small Business: What They Can Actually Run, and What They Cost

A twelve-person recruitment firm bought what the sales call described as an AI employee. Six weeks later it was doing one job: when a CV arrived by email, it read the file, pulled out the candidate’s name, current title and years of experience, and created a record. It did that job well. It also cost roughly nine times what the same job would have cost as a plain automation, because every CV was being handled by a system designed to make decisions about a task that involved no decisions at all. That is the most common and most expensive way AI agents for small business go wrong.

It is not really a mistake about AI, though. It is a mistake about which jobs need judgement. Getting that distinction right before you buy anything is worth more than any platform comparison, so this starts there, then goes through what the three main pricing models actually charge for the same work, the four jobs agents genuinely do better than a workflow, and the guardrails that stop one from quietly costing you money.

The distinction that decides your bill

A workflow runs a path you defined. When this happens, do that, then that, and if this field is empty, do the other thing. It is a flowchart. It can call a model as one of its steps — summarise this, classify that — and still be a workflow, because you decided the order and the model only filled in a blank.

An agent decides the path. You give it a goal and a set of tools, and it works out which tools to use, in what order, and when it is finished. That loop is what the April guide to building a first AI agent with Ollama walks through mechanically, and seeing it written out is the fastest way to understand what you are paying for: the model is called repeatedly, reasoning about what to do next, and each of those turns costs something.

The test is a single question: if you drew this on a whiteboard, would the arrows ever change? Extracting three fields from a CV has fixed arrows. So does sending a reminder when an invoice passes 30 days, which is why no-code invoice automation belongs in a workflow tool and not an agent platform. Researching a company across its website, LinkedIn and three directories until you have enough to score the lead does not have fixed arrows — the second step depends on what the first one found.

Most things sold as agents in 2026 have fixed arrows. They are workflows in a costume, and the costume is the expensive part.

What the three pricing models charge for the same work

The platforms do not just differ in price, they differ in what they count, which is why the same job can vary by an order of magnitude. Figures below come from each vendor’s pricing page on 23 October 2026.

Zapier bills tasks, and agents separately. A task is counted when Zapier successfully completes a unit of work — successful action steps count, while triggers, polling, failed actions and built-in tools like Filter, Formatter and Paths do not. The Free plan gives 100 tasks a month; Professional starts at $19.99 a month on annual billing for 750 tasks and scales up the ladder ($49 for 2,000, $129 for 10,000, $489 for 100,000); Team starts at $69 a month annual for 2,000 tasks with 25 seats. Agents run on a separate unit called activities, which do not draw from your task pool: 400 a month on Free, 1,500 on Professional, with a per-run cap of 10 activities on Free and 40 on paid plans. That per-run cap is the number to notice — it is a hard ceiling on how much thinking a single agent run is allowed to do.

Lindy bills credits per seat. Team is $49.99 a month for 5,000 credits per seat, with larger allotments up the scale and top-ups at $10 per 1,000 credits. Its own guidance puts everyday requests at 2 to 250 credits, deeper work at 250 to 1,000, and large builds at 1,000 to 2,500. The seat model has a sharp edge worth reading twice: anyone who signs up, joins the workspace, or even @mentions the assistant in Slack takes a seat, and seats are billed. When the credit pool runs out, credit-using actions pause rather than auto-billing you, which is a genuinely good default.

n8n bills executions, regardless of complexity. One run of an entire workflow is one execution, however many steps or however much data it moves. Cloud Starter is €20 a month for 2,500 executions, Pro €50 for 10,000, with unlimited workflows and unlimited users on every tier. The Community Edition is free to self-host. For high-volume, many-step work this is the cheapest model by a wide margin, and it is also the one that demands the most of you — somebody has to build and maintain the thing.

Price the same job three ways before choosing. Two thousand CV extractions a month, each needing four action steps, is 8,000 tasks on Zapier — about $129 a month on the Professional ladder. On n8n it is 2,000 executions, inside the €20 Starter tier. As an agent making its own decisions about each CV, on either platform, it is several times either figure for a job with no decisions in it.

What AI agents for small business are actually good at

Research and enrichment across messy sources. The task genuinely has no fixed path: look here, and if that is thin, look there instead, and stop when you have enough. This is the strongest everyday case, and it is the shape behind AI lead enrichment once you go past a single data provider.

Triage that needs reading comprehension rather than rules. Not “route anything containing the word refund” — that is a rule, and rules belong in an automated triage workflow. Agents earn their keep on the residue: the messages that do not match any rule, where something has to read the thing and work out what it is.

Drafting that requires going and finding the context first. Writing a follow-up that references the right previous conversation, the right open quote and the right delivery date means fetching three things from three systems before writing a word. The fetching is the agentic part.

Monitoring for exceptions. Watch a stream of ordinary events and raise the ones that look wrong. The definition of “wrong” is fuzzy, which is exactly why a rule struggles and a model does not.

The pattern across all four: the agent is doing the part where a competent junior would have to look something up and use judgement. Everything either side of that — the trigger, the final write into your system — should stay in a workflow, where it is cheap, deterministic and easy to debug.

The shape that works: workflow, agent, workflow

Nearly every setup that survives contact with real data has the same sandwich structure, and it is worth building deliberately rather than discovering by accident.

Take inbound enquiries at a commercial cleaning company. The trigger and preparation are a workflow: a form submission or an email arrives, the attachment is saved, the sender is matched against existing customers, and a record is created with a status of “needs research”. Fixed arrows, pennies per run, and it fails loudly if a step breaks.

The middle is the agent, and it is given one bounded job: find out whether this is a real prospect worth a site visit. It has three tools — a web search, access to the company register, and a lookup against the firm’s own history — and an instruction that it may make at most six tool calls before reporting what it found, including reporting that it found nothing. Its output is not an action. It is a short structured note with a confidence level.

The write-back is a workflow again: take the agent’s note, update the record, and route by confidence. High confidence and a match on service area goes into the sales queue. Low confidence goes into a human review list. Anything the agent flagged as odd goes to the owner.

The virtue of the sandwich is that the expensive, unpredictable part is boxed in on both sides by cheap, predictable parts. You can cap the middle, log it, and swap it out entirely — including for a human, on a week when it is behaving badly — without touching anything either side of it. A monolithic agent that does all three jobs cannot be bounded like that, and the bounding is most of the value.

Four guardrails, set before the first run

A spend cap you chose deliberately. Every platform has one somewhere. Lindy’s pause-on-empty behaviour is the pattern to copy: the failure mode you want is “it stopped”, not “it kept going”. Set it low enough that a runaway loop is an annoyance rather than an incident.

An approval gate on anything outbound or irreversible. Agents can draft the email, the refund, the calendar invite and the CRM update. A human presses send for the first month, minimum, on anything that reaches a customer or moves money. This is the same discipline that keeps an AI phone answering setup from committing you to something: let it prepare, not conclude.

An explicit list of tools it may touch. Agents are given capabilities, and the temptation is to give them everything so they are not blocked. Give the narrowest set that completes the job. An agent with read access to the shared drive and write access to one folder is a different risk from one with write access to everything.

A log somebody actually reads. Every run leaves a trace of what it decided and why. In week one, read all of them. The characteristic agent failure is not a crash — it is quietly taking a sensible-looking wrong turn on 8% of runs, which nothing surfaces unless you look.

Prove it with a shadow month

Do not launch an agent into live operations and hope. Run it alongside the human for a month, in proposal mode.

The agent does the work and produces its output — the enriched record, the routed ticket, the drafted reply — and a person reviews every one before it goes anywhere. Keep a tally of three numbers: how many proposals were accepted unchanged, how many needed an edit, and how many were wrong in a way that would have caused a problem if nobody had looked. That third number is the only one that matters for the launch decision.

The thresholds are a business judgement, not a technical one. For drafting an internal summary, 80% accepted unchanged is excellent and the bad cases cost nothing. For anything touching a customer or an invoice, you want the “would have caused a problem” number at or near zero across a few hundred runs before anyone stops reviewing — and for most firms the honest outcome is that review never fully stops, it just moves to a sample.

A month of this also tells you the real running cost, which no pricing page can, because it depends entirely on how much the agent flails on your particular data.

Where this goes wrong

Paying agent prices for workflow work. The recruitment firm above. Draw the whiteboard first.

Agent sprawl. Six half-configured agents, each built by a different person in a different week, none owned. One agent with a clear job beats six with vague ones, and the second agent should not be built until the first has run clean for a month.

No definition of done. An agent with a goal it cannot verify it has reached will keep going until it hits a limit. “Find the contact details” is unbounded. “Find an email address, or report that you could not after checking these three sources” is not.

The seat trap. On per-seat pricing, enthusiasm is expensive. Work out who is actually a user before rolling it out to a team Slack where a mention creates a billable seat.

Treating the demo as evidence. Every agent demo works, because it was built against data that suits it. Your data has the client whose name is in the wrong field and the PDF that is a photograph of a document. The shadow month exists to find those before they find you.

The order that works is unglamorous: write down the job, draw it as a flowchart, and if the arrows never change, build a workflow and keep the money. If they do change, give an agent the narrowest version of that job, cap what it can spend and touch, make it propose rather than act for a month, and read every log. Agents that get deployed this way tend to still be running a year later, which is more than can be said for most of the ones bought from a sales call.