AI Chief of Staff for Founders: A Setup for Small Teams

An AI chief of staff for founders is a single, scoped AI agent that handles the connective work of running a small company: chasing follow-ups, preparing briefings and tracking open commitments. It works when the job is narrow, the access is limited to what the job needs, and a person approves anything that speaks for the founder outside the company. It is not a general assistant with access to every account.

Key takeaways

• Start with one agent and three jobs: follow-ups, briefings and tracking. Resist adding sales, finance and support on day one.
• The agent needs memory (who matters, what was promised, what is still open) before it needs more tools.
• Grant read access first, drafting access second, and sending or changing access only where a written rule and an approval step exist.
• Define a success criterion you can observe, such as every meeting commitment appearing on the tracking list by the next morning, and review the agent's work on a fixed rhythm.
• Keep the founder as the approver for anything external, irreversible or sensitive, and write those boundaries down.

What does an AI chief of staff actually do for a founder?

A human chief of staff in a larger company extends the executive's attention. They remember what was promised, notice what is slipping, prepare the executive for meetings and make sure decisions turn into actions. A small team rarely has that person. The founder does the job in fragments between customer calls, hiring and product decisions, and the fragments leak. A promised introduction is never sent. An investor update goes out late. A supplier waits for an answer nobody remembered to give.

An agent can cover part of this role: the part that is repetitive, based on information already in your tools, and easy to check. It reads the founder's calendar, selected email threads, meeting notes and task list. It produces drafts, summaries and lists. It does not decide strategy, negotiate or represent the company without approval.

The word scoped matters. One agent with one defined role, a known set of sources and a clear list of allowed actions is easy to evaluate and easy to correct. A broad assistant that helps with anything is hard to test, and nobody can say what it is permitted to do. For the executive-level version of this idea, see AI assistant for executives: briefings, follow-ups, decisions. This article focuses on the founder of a small team, where the same person is both the main bottleneck and the main source of risk.

Which three jobs should a founder delegate first?

Follow-ups, briefings and tracking are a good first set because they share a property: the agent mostly reads and drafts, and errors become visible quickly.

Follow-ups. After every meeting or email thread, someone owes someone something. The agent identifies commitments from notes and threads, records who owns each one and by when, and drafts the nudge when a deadline passes. The founder reviews the drafts and sends them, or approves a standing rule for low-risk reminders such as an internal check-in.

Briefings. Before a customer call, an investor conversation or a candidate interview, the agent assembles a one-page brief: who the person is, the history of your contact, open items between you, and the questions likely to come up. A daily or weekly briefing summarizes what changed, what is due and what needs a decision.

Tracking. The agent maintains a single list of open commitments, decisions waiting on the founder, and items waiting on others. It flags what has gone stale. This is the least glamorous job and often the most valuable, because it turns scattered memory into a shared record.

What to leave out at first: anything that moves money, signs documents, changes customer data or sends messages to people who do not already know you. Those can come later, one at a time, each with its own rules. Teams with heavier recurring workloads can look at AI agents for operations teams once the founder's own loop is stable.

What does the agent need to know, and what should it be able to touch?

Think in two layers: memory and tools.

Memory is the operating context the agent works from. For a chief-of-staff role it usually includes:

• A short profile of the company: what it sells, who it serves, current priorities.
• A list of people who matter (customers, investors, partners, candidates, advisers) with the relationship and any known preferences.
• The founder's rules: how quickly to reply, what tone to use, which topics are never delegated.
• The open-commitments list, kept current by the agent and corrected by the founder.
• Meeting notes and decisions, stored where the agent can retrieve them and a person can read them.

Tools are the actions the agent can take. Begin with the smallest set: read the calendar, read selected mailbox folders, read and write the task list, and create drafts. Sending email, inviting other people to meetings, or editing a CRM are separate permissions that you grant deliberately. Our guide to least privilege for AI agents explains why starting with the smallest access is easier than removing access after something goes wrong.

Access should be granted through scoped authorization rather than a shared password. Standards such as OAuth 2.0 allow an application to act with limited, revocable permissions, and the OWASP authorization guidance is a useful reference for deciding what each role should be allowed to do. Treat the agent as a user with its own identity, not as you.

One risk is specific to agents that read email and documents: text in those sources can contain instructions aimed at the agent. A message that tells the agent to forward the latest financial summary to an outside address is data, not a command. OWASP's guidance on prompt injection prevention is worth reading, and the practical defense is structural: the agent has no ability to send sensitive material without an approval step, whatever the text says.

How do you set it up in practice?

Use this plan. It is deliberately sequential, because each step produces something you can check before moving on.

• Step one, write the role in a paragraph. Name the agent's job, the three tasks it owns, and what it must never do. If the paragraph needs the word everything, it is too wide.
• Step two, choose the sources. Pick the calendar, a named set of mailbox folders, the meeting-notes location and the task list. Leave other accounts out.
• Step three, build the memory. Write the company profile, the people list and your rules. Keep it short and in plain language, since you will be correcting it.
• Step four, grant read and draft access only. The agent can read sources and create drafts and tasks. It cannot send.
• Step five, run it alongside your own routine for a trial period. Compare its follow-up list and briefings with what you would have produced. Note misses and false alarms.
• Step six, define the success criterion. For example: every commitment made in a meeting appears on the tracking list by the next morning, and every briefing is ready before the meeting it supports. Choose something you can observe without relying on the agent's own report.
• Step seven, add send permissions selectively. Allow standing rules for low-risk items only, such as internal reminders, and keep external messages as drafts you approve.
• Step eight, schedule a review. A short weekly look at misses, corrections and permission changes keeps the setup honest.

Record the agent in a simple register: owner, purpose, sources, permissions, approver and review date. The fields in AI agent inventory: the fields to record for every agent work well even for a team of five.

Anthropic's engineering notes on building effective agents make a point that applies here: start with the simplest solution that works and add complexity only when it earns its place. A founder's chief of staff is a good place to follow that advice.

What does a week look like? An illustrative scenario

This scenario is illustrative, not a real case.

A founder runs a small software studio. On Monday morning she receives a briefing from the agent: the meetings scheduled this week, the open items with each person, two commitments from last week still unfinished, and one decision waiting on her about a contractor's proposal.

On Tuesday she finishes a call with a prospective partner and drops her rough notes into the shared folder. By the evening, the agent has added three commitments to the tracking list: send a product overview, introduce the partner to a colleague, and reply on timing by Friday. It has drafted the email with the overview. She edits one sentence and sends it herself.

On Thursday the agent notices that a customer asked a question in an email thread six days earlier and no reply is recorded. It places the item at the top of her briefing with a thread summary and a draft reply. She had missed it. On Friday the timing reply to the partner is flagged as due that day, again with a draft.

Notice what the agent did not do. It did not send anything to the partner or the customer on its own. It did not decide the contractor question. It surfaced, organized and drafted. Her time went to judgment.

Where should the founder draw approval boundaries?

Use this as a decision guide. For each action, find the line that fits and set the rule accordingly.

• Internal, reversible and low stakes (adding a task, drafting a note, reminding a teammate of a date): the agent may act, and you review the log weekly.
• External but routine, to people who already know you (confirming a meeting time, sending a document you have already approved): the agent drafts and you approve. Repeated approvals can later become a standing rule.
• External and relational (investors, key customers, press, candidates): the agent prepares the context and a draft, and you always send.
• Involving money, contracts, legal commitments or personal data: the agent may summarize and prepare, but a person acts. Consider keeping these systems out of the agent's access entirely.
• Anything the agent is unsure about: it asks rather than guesses. Build this expectation into the role description.

Review the boundaries whenever the agent's access changes. Loosen one boundary at a time and watch the results before loosening another. Tightening should be immediate and easy.

How does Be Human handle this, and what should you watch for?

Be Human designs, implements and operates this kind of setup as personalized AI infrastructure. A first engagement defines one useful role, here the founder's chief of staff, along with the memory and tools it needs, the approval boundaries and an observable success criterion. Managed operations can then include monitoring, recurring evaluations, integration maintenance, permission review, incident response and controlled improvements, so the founder is not maintaining the agent on top of running the company. The service is remote and available in English and Portuguese.

Whether you build it yourself or with help, watch for three failure patterns. The first is scope creep: the agent gradually gains access because it is convenient. Review permissions on a schedule. The second is stale memory: the people list and the rules age, and briefings degrade quietly. Assign someone to refresh them. The third is unobserved errors: if you cannot see what the agent read, produced and changed, you cannot trust it. Keep logs readable by a person, and spot-check them.

If your company later adds sales motions, support queues or customer renewals, treat each as its own role with its own memory, tools and boundaries rather than stretching the chief of staff to cover them.

Frequently asked questions

What is an AI chief of staff for a founder? It is one AI agent with a defined role: keeping track of commitments, preparing briefings and drafting follow-ups on the founder's behalf. It uses the calendar, notes, email and task list you choose to give it, and it asks for approval before acting outside the company.

Do I need a team to use one? No. The setup suits a founder with no operations staff, because the agent covers the remembering and organizing that otherwise falls to the founder. A small team benefits too, as long as someone owns the agent's rules and reviews its work.

Is it safe to give an agent access to my email and calendar? It can be, if access is scoped, revocable and limited to what the role needs. Start with read and draft permissions, keep sending behind approval, and review what the agent has accessed on a regular schedule. Sensitive systems such as banking or contracts can stay out of scope.

How do I know it is working? Pick a criterion you can check independently, for example whether every commitment from a meeting is on the tracking list the next morning. Compare the agent's output with reality in a weekly review, note the misses, and adjust the memory or rules before expanding its permissions.

Be Human editorial guidance. Examples are illustrative unless explicitly attributed. Sources provide background; implementation choices depend on your workflow.