Every week, a business owner loses hours to inbox triage, scheduling follow-ups, and routing tasks that could be handled by a defined rule and a confirmation click.
Short answer: An AI office assistant is an agent, or a coordinated set of agents, that handles routine business communications and tasks under rules you define. You connect it to your email, messaging channels, and internal documents, then configure which actions require your explicit approval before they execute. The platform described in this guide runs on a server you own or rent, so your workflow history, conversation logs, and internal documents stay on your own infrastructure rather than in a shared cloud service. For broader context on using AI in a small business, see the guide to AI for small business.
| Aspect | What it means for you |
|---|---|
| What it is | One agent or several, each with a named role, a declared scope, and a set of tools it is allowed to call |
| Where it runs | A Linux server you own or rent, running Ubuntu or Debian |
| Minimum hardware | 2 vCPU, 4 GB RAM, 20 GB SSD when you route reasoning to an external model gateway |
| What stays on your server | Documents, conversation history, task records, the event log, configuration, and all credentials |
| What leaves your server | The context payload of each request sent to an external model provider, and messages sent through external channels such as public email or Telegram |
| How you pay for it | No per-seat licensing; hosting, maintenance, and per-token model use are your costs |
What you need before you start
The setup path below gives you a system you can inspect, patch, back up, and audit. It also puts the maintenance on you or on someone you hire. That is the whole trade, and it is worth deciding on it before you open a terminal.
It fits when:
- Your business handles internal information that you do not want sitting in a shared cloud workspace.
- You want one node serving the whole team, with no per-user licensing cost added every time someone new joins.
- Someone in the organization can administer a Linux server, or you have a managed service provider who will.
It does not fit when:
- No one can manage a Linux server and no provider is available to do it for you.
- You want a hosted tool with no infrastructure responsibility at all, including operating system updates and backups.
What to gather before step 1:
- A VPS or dedicated server running Ubuntu or Debian.
- At least 2 vCPU, 4 GB RAM, and 20 GB SSD. This is the floor for the configuration in this guide, where reasoning is routed to an external model gateway.
- An account and API key with at least one frontier model provider: Anthropic, Google Gemini, or OpenAI.
- SSH access to the server with administrative rights, so you can install packages and manage services.
- A domain or address for any inbound channel you plan to use: an email address, a Telegram bot token, or the built-in browser chat.
Steps, in order
1. Provision a Linux server that meets the minimum specification. Ubuntu or Debian, 2 vCPU, 4 GB RAM, 20 GB SSD. You end up with a clean machine you can reach over SSH. Falling below this floor is not a performance preference: agent processes compete for memory, and tasks time out or return incomplete answers.
2. Install the Smart Node runtime. Follow the installation runbook at /docs/install. You end up with the runtime running as a service, its internal databases initialized locally, and the event log ready to record every action.
3. Add your model gateway API key to the secret store. The key is stored locally on the server and resolved by the agent at runtime through an allowlist. It is never injected into model prompts and does not appear in conversation logs. You end up with an agent that can reason without a credential ever being visible to the model.
Warning: When an agent calls an external frontier model gateway such as Anthropic, Google Gemini, or OpenAI, the context payload for that request travels over the network to that provider's API, under their commercial zero-retention policy. Your runtime, documents, history, and event log stay on your server. The specific prompt content sent for that request does not. If prompt content must also stay on your own hardware, you need dedicated CPU or GPU compute sized to the model weights you choose, and that is a larger machine than the VPS described here.
4. Create an agent, give it a role and a scope, and connect a channel. Pick the channel that matches the work: browser chat through the office panel, SMTP and IMAP email, or a Telegram bot. You end up with a named agent that answers on a real channel and whose scope is written down rather than assumed.
5. Define the tool capability allowlist for that agent. State which tools it may call and which categories of task fall inside its scope. You end up with an agent that cannot reach past the tools you listed, so an assistant set up for inbox work has no path to your accounting records.
6. Configure human-in-the-loop gates for every irreversible or externally visible action. Outbound email, record deletion, published content, privileged system commands, and monetary spend each hold in a pending state until a person confirms. You end up with an assistant that can prepare consequential work without performing it.
7. Send a test message on the configured channel and watch what happens. Watch the full sequence rather than the reply alone. You end up knowing whether the channel routes, the agent reasons, the gates hold, and the event log records what happened.
Each agent runs in its own isolated system account, and agents reach shared services over authenticated local connections that the kernel verifies. One agent cannot read another agent's mailbox, and it cannot borrow another agent's credentials. That boundary is what makes the tool allowlist in step 5 enforceable rather than a note in a document.
How to check it worked
Run these four checks before live business correspondence flows through the assistant.
- The agent replies on the configured channel, whether that is the office panel, the inbox, or Telegram, within a time you consider reasonable for the task.
- An action that needs approval enters a pending state. Send a test draft outbound email and confirm it waits for your confirmation instead of leaving.
- The event log shows each step in order: what the agent read, which tool it called, and what it produced. You can reconstruct the sequence afterwards.
- No API key, mailbox password, or other credential appears in the conversation transcript, in task notes, or anywhere the model can see.
What goes wrong and how to tell
Warning: The most expensive setup mistake is testing on a live mailbox because it is the one already connected. Connect a test address first, confirm the approval gates hold, then move to the real one.
Hardware below the minimum. Agent processes compete for memory. Tasks time out, sit in the queue, or come back half finished. Check that the server has at least 2 vCPU and 4 GB RAM available to the runtime, not just installed.
Model gateway key missing or entered incorrectly. The agent works until it needs to reason, then returns an error at the point of the model call. Recheck the secret store entry, confirm the key is valid with the provider, and check that the agent's capability allowlist includes the model gateway.
No human gate covering a specific action. The assistant sends a message or modifies a record without pausing, because no gate rule names that tool. Read through the tool list and add a gate for every action that is externally visible or irreversible. Gates apply per action, not per agent.
Channel adapter not connected or misconfigured. Mail arrives in the inbox or messages arrive in the bot, but the agent never sees them. Verify the channel configuration, confirm the address or bot token, and check that inbound routing points at the agent you created.
Frequently asked questions
Will the AI assistant send emails without asking me first?
No. Outbound email is a human-in-the-loop action. Drafts hold in a pending state until an operator confirms them. The same applies to record deletion, published content, privileged system commands, and monetary spend.
Does my business data get sent to OpenAI or Anthropic?
Your runtime, stored documents, conversation history, task records, and event log stay on your server. When an agent calls an external frontier model, the context payload of that specific request goes to that provider's API under their commercial zero-retention policy, and nothing stored locally is used to train third-party public models. Running only on local model weights removes that egress, but it needs compute beyond a standard VPS.
Do I pay per employee who uses the assistant?
No. There is no per-seat licensing, and one node serves an entire team. Infrastructure hosting, server maintenance, and per-token model gateway costs remain, so the total is not zero.
Can multiple people on my team talk to the same assistant?
Yes. The node is not limited by headcount. Anyone with access to a connected channel, whether the office panel, a shared email address, or a Telegram bot, can interact with the assistant, and each conversation is mapped to a persistent thread.
What kinds of tasks can it actually handle?
It handles what flows through its connected channels under its declared scope: triaging and routing incoming messages, drafting replies for your approval, tracking tasks and objectives, looking things up in your internal documents, and running multi-step workflows under defined rules. It does not act outside its scope, and it cannot take an irreversible action without confirmation.
Can I run it without sending anything to an outside AI service?
Yes, if you provision dedicated CPU or GPU compute and configure the node to use local model weights only. A standard VPS is not enough for that configuration, and the hardware requirement depends on the weights you choose.
Set up your node
You have the specification, the steps, and the failure modes. Provision a server that meets the floor, install the runtime, connect one channel, and turn on the approval gates before anything real runs through it. Set up your node.