Every small business with a lively Instagram account eventually faces the same evening ritual: forty unread messages, of which perhaps three matter. The other thirty-seven are the same questions on rotation — price, sizes, delivery, opening hours — each one deserving an answer, none deserving the owner’s evening. Automation is the obvious thought. It is also where businesses quietly wreck themselves.
We build inbox agents for a living, and we ran one on our own account before asking anyone to trust theirs. This guide is what that combination taught us. Where a claim can carry a number, the number comes from our own system’s ledger — measured, not estimated.
The short version
- The agent may only know your approved answers — unknowns are handed to a person, never improvised.
- Money and complaints must be blocked in code, not “instructed” in a prompt.
- Replying yourself must silence the agent on that thread — automatically.
- Duplicates, not latency, are what embarrass you. Exactly-once handling is non-negotiable.
- An agent that answers photos it cannot read is a liability wearing a smile.
How DM automation actually goes wrong
The horror stories are rarely about technology failing. They are about technology succeeding at the wrong thing — replying quickly, fluently, confidently. The damage comes from what it was allowed to say.
The bot that invents a priceA general-purpose model asked “how much is delivery?” will produce a plausible number, because plausible text is its nature. A made-up “$4.99” is a commitment your business never made — delivered in your voice, screenshot-able forever.
The bot that answers the refundMoney questions arrive emotional and legally loaded. An automated reply that concedes fault or recites policy slightly wrong converts an annoyed customer into a dispute — and hands them the transcript to win it with.
The bot that will not stopAutomation without a clean human override produces the worst experience of all: the owner replies personally, and the bot replies again after them. The customer is now talking to a business that argues with itself.
The undisclosed botCustomers forgive an assistant for being an assistant. They do not forgive discovering that the “person” they thanked was software. Disclosure is the cheapest trust you will ever buy — and increasingly, platform policy.
01
The agent knows your answers, not the internet’s
The foundation of a safe agent is a boring document: the answer list. Twenty to fifty questions your customers actually ask, answered in your own words — the same words you would type yourself on a good day. Ours is written in lowercase, because the account’s owner writes in lowercase; the agent inherited the voice along with the facts.
The critical property is not what the list contains but what its edges mean: if the answer is not in the list, the agent does not answer. Not a guess, not a “probably”, not a helpful improvisation — a handover to a person. In our live testing, a question about shipping to another country wasn’t on the list; the agent said a person would confirm, and flagged the gap so the owner could add the real answer once. That is how the list grows: from real gaps, in the owner’s words, never from a model’s imagination.
Unknowns are not an opportunity to be helpful. They are a handover.
the rule that prevented every invented fact in our testingHow to write a list that works
It is an evening’s work, not a documentation project. Scroll your own sent messages for the last month and copy out every answer you have typed more than twice. That is the list — not the answers you ought to give, the ones you actually give. Keep your phrasing: if you write “hey! yes we do”, then that, minus nothing, is the correct entry. One answer per question — a customer asking about delivery wants the number and the cutoff, not the philosophy of your logistics.
Then write the two lists that matter more. The always-a-human list: money, complaints, cancellations, accounts — plus whatever is radioactive in your trade. And the never list: a clinic bans clinical judgement, a restaurant bans allergen guarantees. These two lists are where your professional liability lives — they belong to you, not to a vendor’s template.
02
Escalation lives in code, not in a prompt
Most vendors will tell you their bot is “instructed” not to discuss refunds. Instructions are requests. Under a determined customer — or just an oddly phrased message — a model can be talked past its instructions, and eventually one will be.
The safe architecture puts the rule where the model cannot reach it: in the send path. When our engine classifies a message as money, complaint or account access, the transmitting code itself refuses to send anything beyond a fixed-shape acknowledgment — whatever the model generated. The customer reads calm; the owner receives everything:
A customer needs you TIER 1
“i paid for a plan and want a refund”
Your agent already said: “i understand. i will pass this to a person on the team and they will get back to you here about your refund.”
The packet carries the customer’s exact words, the agent’s exact words — quoted so the owner never contradicts what was already promised — and every detail captured along the way. We watched this fire live on the message every owner dreads; the whole exchange, ledger rows and all, is in our case study.
03
The human outranks the agent, without pressing anything
An override that requires opening a dashboard is an override that fails at 9pm on a Saturday. The only override that works is the one the owner performs by accident: replying. When the owner answers any thread personally, the agent detects the human message and goes quiet on that thread. No mode to remember, no app to open.
A good inbox agent adds no inbox. The customer stays in Instagram; the owner stays in Instagram and email. A vendor whose product requires your staff to learn a new console has given you a second job, not an employee.
04
Exactly once, and written down
Here is the least glamorous principle, paid for with our own embarrassment. During testing, a silent file-permission failure caused our worker to re-process the same messages on every cycle — the same decisions made twice, duplicate escalation mails, and, had it been live, the same customer greeted repeatedly by a business that appeared to have lost its mind.
Message delivery on these platforms is “at least once” by design — the same event can legitimately arrive twice. Your automation must therefore be exactly-once by construction: every event claimed in a write-once record before any work happens. And every decision — answered, escalated, refused, skipped — must become a ledger row. Not for compliance theatre: the ledger is how the owner’s reports get their numbers, and how a claim like “first reply in 61 seconds” can be checked rather than believed.1
Worth knowingSub-second replies are a vanity metric. Our first real reply took 61 seconds — most of it a deliberate one-minute polling cycle that makes exactly-once behaviour easy to audit. For customers used to hearing back the next morning, one minute and six seconds are the same miracle. Duplicates, not latency, are what embarrass you.
05
Refuse what you cannot read
Run a real inbox through an agent and you discover the dirty secret of DM automation: much of it is not text. When we pointed ours at a live account, six of the nine most recent conversations were photos or shared posts with no words at all. A grounded agent has nothing to stand on there. It could compliment the picture, guess the intent, or fire a generic “thanks for reaching out!” — each of which trains customers that the account talks without listening.
Ours refuses them, and its report says so plainly: these six are yours. The ratio will vary by business; the principle will not.
The 24-hour windowBusinesses reply inside a 24-hour messaging window after a customer’s message. Unanswered evenings are expensive — and the handover mail shows the owner how much window remains.
Official APIs onlyThe owner authorises through the platform’s own consent screen and can revoke at will. Grey-market tools risk the account itself — a strange trade for saving time on messages.
Week one: the probation plan
Treat the rollout like the first week of a new hire, because that is what it is.
1–2days
Drafts onlyThe agent reads real messages and writes real replies — and sends none. You read the drafts each evening: is the voice yours? Which escalations would one more list entry prevent? Fix the list, not the agent.
3–5days
Live on the routineKnown questions answered in about a minute; everything on your always-a-human list still lands in your mail with the full packet. Read the “agent already said” line before replying, so the two of you never contradict each other.
7day
Read the summary honestlyThe report contains a section brochures never mention: could not answer. That section is the product working — add those answers in your own words and next week’s section shrinks. An agent with no such section has a vendor who is hiding it.
After week one you will know, from your own inbox and your own numbers, whether this earns its keep. A pilot on your real messages beats any demo — including ours.
Seven questions to ask any vendor — including us
You do not need to audit anyone’s code. The answers to seven plain questions predict almost everything:
Q1“Where do the answers come from?”
The only good answer: from content you approved. Anything resembling “our AI is trained on…” means invented facts in your voice.
Q2“What happens when a customer mentions a refund?”
Listen for “the code refuses”, not “the bot is instructed”.
Q3“What does it do with a photo and no words?”
If the answer is anything other than “hands it to you”, ask to see the reply it sends instead.
Q4“How do I override it?”
The right answer: reply, and it goes quiet. If the answer involves a dashboard, imagine Saturday night.
Q5“Is it disclosed as automated?”
Yes is the only acceptable answer — for platform policy and for trust.
Q6“Can the same message ever be answered twice?”
Watch whether they understand the question. At-least-once delivery is a platform fact; exactly-once handling is the vendor’s job.
Q7“Can I read what it would say before it goes live?”
A confident vendor runs it in draft mode on your real inbox and lets the drafts argue for themselves.
That last question is the philosophy in miniature. An inbox agent is a hire. You would not let a new employee answer customers unsupervised on day one — you would read over their shoulder for a week. Software deserves the same probation.
The economics, honestly
There is a build — the answer list turned into a configured agent, tested against your own past questions — and a monthly cost with two parts: tuning (someone keeps the answers current and reads the reports so the list keeps growing) and the AI usage itself. We run usage on accounts the client owns, so the real cost is visible on their own bill rather than marked up inside ours.
Whether it earns its keep is napkin arithmetic: count last week’s messages, subtract the ones that genuinely needed you, multiply the rest by the two minutes each steals — once to read, once to answer. Against that, weigh the one number automation must never cost you: a single invented answer to a money question. The five principles exist because the second column outweighs the first.
And if the napkin says twenty messages a week? Then you do not need an agent, and a vendor who says otherwise is selling you software instead of an outcome. Answer them yourself with the list you wrote in an evening; come back when volume hurts.
What we run, measured
61sfirst real reply, arrival to sent1
~2smedian engine decision1
3 of 9threads drafted; 6 photo-only refused2
100%money questions handed to a person3
1. worker ledger, first live day · 2. live inbox read with skip counters · 3. enforced in the send path; the model cannot override it. Full chronology, including the two bugs we caught: the case study.
Every number from the ledger · measured, not estimated
SSathish B · Founder, iHayzBuilds and operates AI agents for small businesses — and runs every one of them on his own accounts first. Everything in writing, no calls.
The simulator on our Inbox Agent page answers liveAsk it the refund question and watch it stop
Try it →
Want it reading your inbox?A private demo link: one hour, read-only, drafts only. Nothing is sent to anyone.
Ask for a demo link