Business operator agent: context, tools and control
An operator-agent setup for a one-person business: messaging, business notes, email reading and scheduled activities. Not a finished customer-support bot.
What was built?
A containerised agent service connected an allowed messaging channel, local interface, scheduler and Markdown knowledge vault. Gmail OAuth supported unread-email checks, with sending behind a separate approval step. Secret masking in logs and a policy-rule prototype were also examined. These parts did not constitute proven universal data-leak prevention.
Workflow and review boundary
Task
The business owner assigns a bounded task.
Business context
Instructions and the knowledge vault relate the task to the business.
Read and prepare
Tools can check unread messages and prepare a summary or draft.
Human approval
Sending and external commitments require a separate decision. A prohibition in a prompt is not equivalent to a technical barrier covering every tool.
Verify
Read back the result and distinguish a real action from the agent’s claim that it completed the work.
What operation revealed
Model claims must match the actual configuration.
Documentation described different model routing from the active configuration. Privacy and cost assessments must use the actual destination of data rather than an old description.
A prototype is not an enforced safeguard.
A local policy pack existed, but the source review found it was not connected to tool dispatch. Its check could not be rerun in the inspected environment.
Masked identifiers do not make a conversation anonymous.
Log and identifier masking did not remove every personal detail from message bodies. Security descriptions must explain both coverage and exclusions.
My contribution
I defined operating practices, approval boundaries and business context. AI helped with research, drafts and configuration. This adapts an existing agent runtime; it is not a customer-support platform built from scratch.
Data boundaries
A local vault does not mean its used content stays on the server. Context can go to an external model service; email and messaging services have separate boundaries. This case does not establish that all data remains in Europe.