What a Digital Employee Is and Whether One Fits Your Business

Before you build a business process around a digital employee, you need to know what it can own, what it cannot do without your sign-off, and what it costs you to run.

Short answer: A digital employee is an AI agent assigned a defined role and a bounded set of tools, set up to work inside the communication channels your business already uses. It takes actions rather than only answering questions: drafting and routing messages, tracking tasks, retrieving and writing documents. It cannot send external messages, delete records, or spend money without explicit human confirmation.

Five things that determine whether this fits your business

Each of the five is a real constraint, not a wish list. A platform can be excellent on four of them and still be wrong for your business because of the fifth.

1. What kind of work a digital employee can own

A digital employee holds one role with a declared set of permitted tools, not a general mandate to be helpful across anything.

At setup you define the boundary: which tools the agent may call, which documents it may read or write, which tasks it may route to whom. That definition is structural. The agent does not gain reach because someone asked it politely in a chat, and one agent's grant does not extend into another agent's files. On the same server, a customer inquiry agent and an internal coordination agent can hold entirely different roles with different limits, and neither can borrow the other's permissions.

Behind that boundary sit three shared components. A task tracker records and routes work so items do not disappear between conversations. Memory stores context between sessions, so a follow-up request does not restart from zero. Documents are kept in a version-controlled repository, so a draft has a history and a place to be discussed.

The practical effect for a small company is that delegation is decided once, on paper, before the agent does anything. If you are still working out where AI belongs in your operations at all, start with the broader picture before you pick the first task to hand over.

2. What it decides alone and what requires your approval

Five categories of action stop before they execute: sending external email, publishing content, deleting records, running privileged system commands, and spending money. Each one waits for a person to confirm it.

That gate sits in the execution path. It is not a setting an administrator can switch off, and it is not a request in a prompt that a model could be talked out of. The agent can research, draft, prepare, and queue an action. Releasing it is a human decision.

Warning: If a vendor cannot show you the list of actions that pause for confirmation, assume no such list exists. A gate that lives in a policy document rather than in the code path is a description of intent, not a control.

What this buys you is bounded autonomy: agents operate inside declared scopes with least-privilege tool grants, and the consequential steps are yours. What it costs you is a confirmation click on exactly the actions you would want to review anyway, which is the point.

3. Where in your business a digital employee operates

Supported channels include browser-based web chat from the office panel, email over SMTP and IMAP, Telegram bots, voice sessions through the Gemini Live API, and internal agent mail. Channel adapters map each conversation to a persistent thread, so context carries across sessions and across handoffs between agents.

For daily operations that means the agent appears where work already arrives: in the shared inbox, in a chat window, behind a Telegram handle, or on a voice call. Nobody has to remember to open a separate tool and re-explain the situation.

4. Where your data goes

Records, documents, and memory sit in local storage on infrastructure you own or rent, under single-tenant ownership. Nothing in that storage is used to train third-party public models. Credentials stay in a local secret store and are resolved locally by tool wrappers; they are never injected into a model prompt.

That is half the picture. The other half is model inference. Smart Node runs a hybrid inference model: some work goes to open-weight models on your own CPU or GPU, and complex reasoning frequently routes to an external frontier LLM gateway such as Anthropic Claude, Google Gemini, or OpenAI. When a task takes that route, the specific context payload in that request crosses the network to the provider and is governed by the provider's commercial zero-retention API policies. Messages sent through email, Telegram, or cloud voice also traverse those external networks.

Warning: "Private AI" and "air-gapped" are different claims. Local storage does not train public models, but a deployment with external model gateways is not isolated. Genuine air-gapped operation requires every model to run on your own hardware with no outbound network path, which is a deliberate configuration and a hardware decision, not a default.

5. What it costs to run

There are no per-seat fees. A single node serves an entire team, so headcount does not change the licence line.

What replaces that line is infrastructure. A base node running against remote model gateways needs a minimum of 2 vCPU, 4 GB RAM, and 20 GB SSD, which fits a modest VPS. From there you pay for hosting, operating system maintenance, monitoring, backups, and recovery. Per-token charges from any external model provider are additional and depend on how much work you route to them.

Running everything locally removes the per-token cost but not the hardware cost: fully private inference requires dedicated CPU or GPU compute sized to the model you choose. The trade-off is direct. A per-seat vendor absorbs the server, the patching, and the uptime risk on your behalf. Here, those land on you or on an integrator you hire, in exchange for data that stays on your own machine and no per-user pricing.

What to look for

It fits when:

• Work follows defined steps with observable outputs: a queue of customer inquiries, documents drafted from templates, tasks routed to owners, a report produced on schedule.
• You can run a Linux server yourself or through a managed service provider.
• External communications follow templates, so a human review before sending reads as a feature rather than friction.
• The team accepts confirming external messages, deletions, and spend before those actions execute.

It does not fit when:

• Work needs real-time judgment with no definable criteria or process behind it.
• Nobody in the organisation can administer a server and no managed provider is available.
• Regulatory requirements demand complete air-gapped operation and dedicated local GPU inference is not provisioned.
• You need turnkey software that requires no technical administration at all.

Red flags

Four signals in a vendor pitch indicate that the oversight mechanisms are missing rather than merely unmentioned.

Warning: The claim to test first is autonomy. A platform that advertises an agent acting without supervision, and never documents where it stops, is asking you to trust a boundary it has not drawn.

• The agent is described as fully autonomous, with no mention of approval gates for external actions or deletions.
• There is no document listing which actions pause for confirmation and which execute immediately.
• There is no disclosure of what data is sent to external model providers, or under what retention policy.
• Pricing scales with headcount. A single node serves a team at flat infrastructure cost, so per-user pricing means the per-seat line item you set out to remove is still on the invoice.

Questions to ask before committing

• Which specific actions require human approval before execution, and where is that list documented?
• When a task uses an external AI model, what data is sent, to which provider, and under what retention policy?
• Does the licence cost scale with the number of people who use the system?
• Can different agents on the same system hold different roles and different capability boundaries?
• What are the minimum server requirements, and who owns maintenance, backups, and security updates?
• Which communication channels does the platform support natively, and which need custom work?
• If the server goes offline, what restarts, what is lost, and who runs the recovery procedure?

Frequently asked questions

Is a digital employee the same as a chatbot?

No. A chatbot answers questions inside one conversation; a digital employee has a role, a set of permitted tools, and the ability to act. It routes tasks through a tracker, writes to documents that have version history, and carries context between sessions. The difference that matters operationally is the tool grant and the approval gate, not the quality of the conversation.

Can a digital employee send emails without me reviewing them first?

Not external ones. Sending external email is one of the five action categories that pauses for explicit human confirmation before execution, along with publishing content, deleting records, privileged system commands, and monetary spend. Drafting and preparing the message happens without a gate; the send waits for you.

Does my business data leave my server?

Part of it can. Records, documents, and memory stay in local storage on your server, and that storage is never used to train third-party public models. But when a task routes through an external model gateway, the context payload of that request travels to the provider under its commercial zero-retention API policy. Credentials never travel that way: they stay in the local secret store and are resolved by local tool wrappers. Email, Telegram, and voice traffic also crosses those external networks by nature.

How many people on my team can use one digital employee at the same time?

Licensing does not set that ceiling. There are no per-seat fees and one node serves an entire team. What limits throughput is the server you provision and the models it routes to, so size the host against your own traffic rather than against a published seat count.

Do I need a technical person on staff to run one?

You need someone who can administer a Linux server, either on staff, through a managed service provider, or through an integrator. That covers operating system updates, monitoring, backups, and recovery. The platform removes the per-seat licence, not the operational responsibility of running the machine it sits on.

Next step

Review the five dimensions against your own operations, then deploy a private node on hardware you control: Get started.