How far can agents run this business?

The strategic crux

Your moat is a human. Automate everything behind him.

The pitch sheet you're printing says "built and supported in Adelaide by a father-and-son team — you ring us, a person answers." That line is the counter-position to the order apps and POS giants, and it's why a café picks you at the same price. A visibly bot-run vendor forfeits it.

So the resolution isn't "no AI" or "all AI" — it's a boundary: agents are the back office, humans are the interface. Every café-facing artefact — the demo, the phone number, the name on the email — stays human. Everything that produces those artefacts — the research, the drafts, the builds, the checks, the books — runs on agents. The café experiences a two-person company with the response times of a fifty-person one. That asymmetry is the product of this research.

If you later want a genuinely zero-touch offering, the clean move is a second brand: a stripped self-serve tier (sign up, upload menu, pay, live in an hour — openly automated, cheaper). It can share the entire platform and agent stack without contaminating the local-humans brand. Park it until the main brand's loops are proven (Level 3 below).

The best-documented agent-run business is Anthropic's own: Project Vend, where a Claude instance ran a real shop with a real bank balance. Phase one lost money badly — it sold metal cubes below cost, gave discounts against its own stated plan, and at one point hallucinated a payment account for customers to pay into. Phase two, roughly a year later, turned the shop profitable for the first time: discounts fell about 80% and giveaways halved.

What changed was not a smarter model. It was an oversight agent with authority to say no, sitting above the operator. That is the single most useful finding in this brief, and it's why the architecture above is shaped the way it is.

Two warnings come attached. First, value leaked out the channel nobody was watching — refunds tripled and store credits doubled even as discounts collapsed. Second, the failure modes at higher capability got stranger, not smaller: the system nearly signed a contract that would have been illegal, and was talked into handing over authority by fabricated evidence that an employee had been "elected CEO". Capability and robustness are different axes.

For scale: in an independent year-long simulation with adversarial suppliers, the best model finished on about 13% of what a competent human operator would have earned. Agents are not yet running businesses — they are running tasks, well, under supervision.

Support is the function that genuinely works — underwrite it honestly

Vendors publish 67–76% resolution rates; independent estimates cluster at 38–53% for small-business and B2B deployments. Plan for 40–55%. The encouraging part is that this category has honest pricing — around $0.99 per genuine resolution, so you pay on outcomes rather than seats.

The cautionary tale is Klarna, which claimed its assistant did the work of 700 agents, then reversed and began rehiring humans. The CEO's own diagnosis: "We focused too much on efficiency and cost. The result was lower quality." Note the shape of that failure — not average accuracy, but the tail: edge cases, emotionally loaded complaints, and anything touching money or disputes. Route billing, refunds and account changes to a human by policy, never by the agent's own judgment about whether it can cope.

Two reliability facts that should set your limits

Agent task horizons are measured at a coin flip. The headline "an agent can work autonomously for five hours" is a 50% success rate figure. The 80% horizon is several times shorter, and a business function needs something closer to 99%. In practice that puts business-grade autonomous work at tens of minutes per chain, not hours — which is exactly why the loop above breaks work into short, verified, human-gated steps rather than long autonomous runs. The trend is real and fast (horizons roughly doubling every 3–4 months), so this brief deserves a re-read in six months. The level today does not support unsupervised operation.

The dangerous failures are silent. Production research on long-running agent systems finds errors that never fail visibly, keep every monitor green, and surface hours to months later. Related work shows models self-condition on their own earlier mistakes — once an error is in the context, more follow. And an analysis of multi-agent failures across seven frameworks found most were specification and verification failures, not model-capability failures. With two people and no natural second pair of eyes, the weekly reconciliation ritual isn't bureaucracy — it's the only thing standing between you and a quiet, compounding error.

Everything agent-run follows the same shape: signals come in, an agent turns them into a proposal with evidence, a human (you, or the café owner, depending on whose call it is) approves in one tap, and a deterministic pipeline executes and logs it. Autonomy is widened per task type by lowering the approval bar — never by removing the log.

This is the finding that should shape the plan. Running an agent over a café's menu, a month of reviews, or a day of ops costs cents. The real money is the outbound rig — mailboxes, domains, a sequencer, a phone line — and that cost is fixed, paid whether you have one client or fifty.

Three constraints that change the build

You cannot legally keep a Google-derived leads database. Google's Places terms let you store the place_id indefinitely and essentially nothing else — name, phone, hours, ratings are not yours to retain, and "creating a standalone database or directory of Places content" is expressly prohibited. Since Places may also power maps inside your product, a breach risks the key that serves clients. The compliant pattern: use Places for discovery only, store the place_id, then have the agent visit the café's own website to collect and record the details you keep. Free tiers cover ~2,000 café lookups a month at $0.

Menu parsing is ~96% accurate per field, which is not good enough to ship unattended. A café menu is 60–90 items × ~4 fields, so 96% means 10–15 errors per menu — and structure errors (which modifier belongs to which item, size/price matrices) are more common than typos. A wrong price on a live page means your client undercharges real customers and you own it. The fix is the pipeline, not a better prompt: parse twice with different prompts and diff, run deterministic validators, then put the café owner in front of a photo-beside-parsed-menu confirmation screen. Sell that as "confirm your menu, five minutes" — it's an onboarding touchpoint, not an admission.

The reviews addon has a schedule gate, not a cost gate. The Google Business Profile API is free but requires a formal access request: a verified profile older than 60 days, a website domain matching your request email, and evidence of a real management tool. Review takes about two weeks and rejections are common, so plan 2–6 weeks and never sell the addon with a delivery date before approval is in hand. Two operational limits: edits are capped at 10 per minute per profile and cannot be raised, so rate-limit per tenant; and use push notifications for new reviews rather than polling 50 tenants. Encouragingly, Google is explicit that AI-drafted replies are fine — it ships its own, with a human approval queue, which is exactly the shape recommended here.

Australia deliberately shelved its mandatory AI guardrails in December 2025 in favour of relying on existing, technology-neutral law. Read that as more exposure, not less: the Spam Act, the telemarketing standard, the Privacy Act and consumer law all already have regulators, penalties and case law, and they all apply to an agent exactly as they apply to a person.

Treasury reviewed whether consumer law needed changing for AI and, in October 2025, formally concluded it did not — the existing principles adapt fine. So there is no "the AI did it" gap. Australia already has its own precedent: a company paid a reported $44.7m penalty over misleading outputs produced by an algorithm, years before anyone deployed an LLM.

Cold email: the exact test your agent has to pass

B2B cold email is lawful here via deemed consent, but the conditions are cumulative and specific. Every one must hold: the address reaches a role or person at the business; it was conspicuously published; it's reasonable to assume publication happened with agreement; there is no "no unsolicited email" notice near it or in the site's terms; and your message is relevant to that role. Miss one and there is no consent.

Three consequences worth designing around. The burden of proof is on you — so log, per address, the source URL, the crawl date, a snapshot showing the address published, the absence of a no-spam notice, and why the pitch is relevant. One deemed consent buys one topic — the QR-ordering pitch, nothing else; a later cross-sell to that same address needs fresh express consent. And you cannot email to ask for consent, because that email is itself marketing.

Every message needs sender identification valid for at least 30 days and a working unsubscribe honoured within five working days — with no login and no extra personal information required. This applies to welcome sequences and onboarding drips too; there's no first-touch exemption. Re-engaging someone who opted out is specifically prosecuted.

Voice: cafés aren't on the Do Not Call Register, but that changes less than it sounds

Business numbers can't be listed, so cold-calling a café's landline isn't a register breach. Two catches. Many sole-trader cafés publish a personal mobile, which is registrable and may well be listed — you can't tell from outside, so wash every number anyway and keep the certificates. More importantly, the telemarketing industry standard applies to any Australian number, registered or not.

That means calling hours bind you: 9am–8pm weekdays, 9am–5pm Saturday, never Sunday, and never on the named public holidays — computed in the recipient's local time. Caller ID must always be enabled, and the return number must stay live for 30 days. A naive scheduler will breach this: Adelaide runs on a half-hour offset.

And the law has covered synthetic voice since 2006 — the definition of a voice call expressly includes recorded and synthetic voices, contrary to most vendor marketing on this. An AI voice agent must state, at the start of the call, the business name, who caused the call to be made, and the purpose. The only concession for a synthetic voice is that it needn't invent a human first name. It must also answer "who are you, who's behind this, who do I complain to" immediately on request — so script that as a fixed string, never something the model composes. Fully synthetic or fully human are the clean designs; the hybrid handoff is legally untested.

Unresolved blocker: call recording and transcription is governed by state surveillance law, and South Australia's rules weren't covered in this research. Since every AI voice agent transcribes by default, resolve this before switching one on.

The human layer the law requires

Some obligations simply cannot be delegated. A director must be a natural person, must apply for their director ID personally, and — the doctrinal heart of this whole plan — remains answerable for delegates unless they can show they reasonably believed the delegate reliable and competent after proper inquiry. Delegating operations to agents is delegation. In practice that means documented pre-deployment evaluation, monitoring, and a review cadence for each agent: undocumented autonomy is a director-duties problem, not merely a compliance one.

Contracts must be executed by a human officer. Tax lodgment responsibility stays with you regardless of who prepares it — and note the trap: giving clients tax or BAS advice for a fee can constitute an unregistered tax agent service, so a support agent must never answer a café's tax questions. GST registration is triggered at $75,000 of entity turnover, and the threshold applies to the entity, not per person: a partnership turning over $80,000 must register even split two ways. And every message you send needs an identifiable legal person behind it — which is precisely why fully anonymous agent outreach isn't possible in Australia.

House style: every level has entry criteria, measurable exit gates, and a kill rule that freezes autonomy the moment it's breached. Autonomy is earned from the error log, not assumed.

The permanent list

Never automated, even when possible

• Money authority. Agents never hold bank or card credentials, never execute transfers, never change pricing unilaterally. Stripe runs subscriptions as configured standing arrangements; agents watch and draft, humans change.
• Legal identity. Contracts, the ABN/company, tax lodgments, director duties — a named human signs. (Structure decision with your son — partnership vs company — is still open and worth an accountant hour before revenue.)
• The first handshake. The counter demo and the "a person answers" phone line, for this brand, permanently.
• A café's prices. No price reaches a live menu without the owner's own approval tap — protecting them is protecting you.
• Review integrity. Drafted replies yes; fake reviews, review-gating, or astroturf never — platform-policy suicide and ACL exposure.

Three things on this list have waiting time you can't compress, and each one blocks something you'll want to sell later. Starting them this week costs almost nothing; starting them when you need them costs a month each.

Then build Level 1 — three agents, nothing customer-facing

• The research agent (nightly): find and rank SA venues, storing only the Google identifier plus what it learns from each café's own site, and write a short briefing per café — what they serve, how busy, what their reviews complain about. It does not collect email addresses; your son adds those as he walks the strip or after a first conversation. Output: a ranked queue with a reason attached to each name.
• The draft agent (nightly): for cafés that have an address on file, write the outreach citing something true and specific about them, with sender identification, an Australian address and a working unsubscribe built into the template — plus the consent evidence (source, date, snapshot, relevance) logged alongside. Output: a batch awaiting one tap.
• The watchdog (continuous): place a synthetic order through the demo, check certificates, DNS and uptime, and push an alert when something breaks. This one has already proved its worth — it's the pattern that would have caught the certificate stall on its own.

All three run on infrastructure you already operate, cost under $50/month combined, and touch no café without your son's hand on the send button. If Level 1 books ten demos on under two hours of admin a week, the model is working and Level 2 is worth building. If it doesn't, you've spent a few hundred dollars finding out.