For a 20-person accounting firm, which AI client-chasing jobs need a person to approve?
Let an AI agent act on its own only for internal, reversible work: triaging the inbox into a review queue and adding provisional call summaries with links back to the source. Anything that reaches a client or prospect, including document chases, replies, deadline changes, advice or commitments, should be drafted by the agent and sent only after a named person approves that exact message. The same split holds for a 10 to 30 person agency or consultancy.
Three ways to set the boundary
- A fully autonomous agent that acts fits when the job needs variable multi-step reasoning, the result can be checked against source records and the allowed actions are narrow, tested and easy to undo; avoid it for client-facing messages, prospecting, commitments, anything destructive and any job where nobody would notice a wrong result.
- An agent that drafts and flags while a designated person approves every external send fits when incoming language varies and drafting saves real time but a client, deadline or professional judgment is affected; avoid it when the reviewer has no time or source context, or when the tool can send around the approval gate.
- No agent, with fixed templates, checklists and a manual chase calendar, fits when the volume is small, the requests are predictable or nobody can own the review step; avoid it when the team is already missing chases because the inbox outruns the people reading it.
Anthropic's engineering guidance, published December 19, 2024, separates open-ended agents from predefined workflows and warns that the autonomous nature of agents brings higher costs and the potential for compounding errors. The same article says the right answer can mean not building agentic systems at all. Its framework list is dated, as the page itself notes, but the architecture principle holds.
Recommendation for a small accounting or services firm
Most 10 to 30 person firms should run the middle option. The agent reads incoming mail, sorts it, summarizes calls and drafts the chase or reply. A specific employee, such as the practice manager, with a named backup, approves each outbound message before it leaves. Internal triage and provisional summaries can run unattended once tested, because a wrong result lands in a queue a person reviews anyway.
One condition would change the recommendation: if a job's output can be verified automatically against your own records and undone cleanly, such as moving a summary item between internal queues, that single action can graduate to autonomous. Client-facing sends never meet that bar, because a wrong email cannot be recalled once a client has read it.
Leaving the boundary undecided has a cost either way. An agent wired straight to the outbox can ask a client for documents they already sent, promise a turnaround nobody agreed to, or mail prospects who never asked, and each mistake creates a fresh round of client work and apologies. Gmail and Yahoo reject or filter mail from senders who generate unwanted traffic, so a careless outbound run can damage the domain the whole firm relies on for client email. Doing nothing has its own price: chases slip, documents arrive late and staff spend deadline weeks reading the inbox instead of doing the work.
The practical fix is an agent that does the reading and drafting while a person keeps the send button, so you avoid robotic emails nobody answers, wrong replies to clients and a burned sending domain. Chrysis builds that kind of setup for small firms, with an AI agent that drafts every chase while your team approves what goes out, tied to the records the firm already uses.
Job-by-job permissions for client chasing, triage and call summaries
- Inbox triage into an internal queue: autonomous candidate, provided every item links to the original message and a person works the queue.
- Provisional call summaries added to an internal review list: autonomous candidate, with source links and an undo path; the agent never edits a filing deadline on its own.
- Document-request chases to clients: draft only; the approver checks that the document is still outstanding before sending.
- Replies to client questions: draft only; anything resembling advice goes to the responsible accountant, not just the practice manager.
- Prospecting or outbound sales email: draft only, and small batches, because sender reputation belongs to the whole firm.
- Changes to deadlines, engagement terms or client records: blocked for the agent; a person makes the change.
How the approval gate should work
Anthropic's April 9, 2026 article on trustworthy agents describes per-action permissions of always allow, needs approval and block, and gives the example of allowing calendar reads while requiring approval before sending an invitation. The same article warns that agents act with less human oversight, so there is more room to misread intent and take actions with unintended consequences, and it covers prompt injection, where text inside an email tries to instruct the agent. An accounting inbox full of outside senders is exactly that exposure.
A working gate shows the approver the source message, the intended recipient, the exact draft, any attachments and any proposed record changes. Approval has to gate the actual send rather than notify someone afterward, and any edit after approval should require a fresh approval of the new version. The agent itself should hold no permission to send; the send credential sits behind the approval step.
Microsoft Copilot Studio's request for information action, documented on a page last updated June 30, 2026, can pause a flow and collect input from designated human reviewers before later steps run. Requests go through Outlook, cannot be sent to users outside the tenant and only the first response is used. That makes it an internal reviewer mechanism, and a firm still has to build and test an explicit yes or no branch plus a separate send permission before treating it as send approval.
Outbound volume brings separate rules that apply whether a person or a model wrote the email. Google's sender requirements, effective from February 2024 for senders of 5,000 or more messages a day to Gmail accounts, require authenticated mail, no unwanted or unsolicited email and easy unsubscribe, and Google says enforcement on non-compliant traffic ramped up starting November 2025, with temporary and permanent rejections. Yahoo began enforcement in February 2024 and enforcement of its List-Unsubscribe policy in June 2024.
Frequently asked
Can an AI agent send document chases to clients on its own?
Not safely in a small accounting firm; let it draft the chase and have a named person confirm the item is still outstanding and approve the send.
Who should approve AI-drafted client emails?
One named employee, usually the practice manager, plus a backup, with technical or advisory replies routed to the responsible accountant.
Do Gmail and Yahoo ban AI-written email?
No; their rules cover authentication, unwanted mail and unsubscribe handling, and they apply to every sender regardless of who wrote the message.
Is Microsoft's request for information action a client send-approval system?
Not by itself; it pauses a flow for internal reviewers inside the tenant, and the yes or no branch and send permission still need building and testing.
When should a firm skip the agent entirely?
When volume is low, requests are predictable or nobody has time to own the review queue; templates and a chase calendar will do the job.