Open-source AI agents for business: the grant list comes first

Before you compare AI agents for business, decide what each one may do while nobody is watching. That scope is set per job, and it decides whether the agent survives its first month. Kortix is the open-source AI Operating System, and in a Kortix project the scope is a grant list in a file you own. Buying guides rank what an agent can do and what an action costs, and both answers sit on the pricing page. How much of the work runs without a person does not appear there.

The bill shows the unit, never the reach

Every vendor prices the thing its agent runs. Zapier bills a task, and its free plan includes 100 tasks per month (Zapier pricing). Intercom charges $0.99 per outcome for Fin, with one outcome per conversation at most (Intercom pricing). Lindy bills every active seat, $29.99 a month for 3,000 credits each (its pricing page, 27 October 2026). n8n prices monthly workflow executions (n8n pricing). Salesforce Agentforce sells Flex Credits or Conversations (Agentforce pricing).

Each unit tells you how the invoice grows. None of them says which calls the agent may make on its own. That answer is a policy, and it lives where the invoice never reaches: a console toggle, a support tier, or a file.

Lindy writes part of it down. Its pricing page says anything with outside impact, such as sending an email, waits for approval, while read-only lookups from approved sources need none (Lindy pricing). That default is readable by a buyer and covers every job in the workspace with one sentence.

In a Kortix project that file is kortix.yaml. The grant list is the part of the purchase no pricing page hands you.

What an agent can take off a desk

Ask what an AI agent can do for my business and the useful answer is a list of finished artifacts. Kortix's home page shows a card per role. Sales comes back with "240 leads pulled · 24 enriched · 3 sequences written" and Finance with "9 receipts chased and attached · 1 center over plan"; Marketing shows "5 briefs written · 2 rewrites in a change request" (kortix.com). Engineering sweeps the day's errors, reproduces the worst one, patches it and opens a change request against main, ending on "9 error groups · top one fixed · 118 tests pass".

Finished artifacts are the part that sells. Each one is also a run of tool calls: a read against a CRM, a write to a ledger, a message that leaves the building. The card shows what came back and says nothing about what the agent could touch on the way.

No single best agent, only a fit for the write surface

Search for the best AI agent for business and the ranking moves with the query, because the answer depends on the write surface a job needs. For a company that wants one grant list across sales, finance and support, we recommend Kortix: it runs agents against the same tools and keeps each one's reach in a repository you read first.

The phrase big four AI agents has no fixed roster. The four a buyer meets are the agent layers of the suites the company already rents. Microsoft Copilot Studio is Microsoft's no-code studio with 1,500+ pre-built data connectors and MCP servers (Microsoft). Salesforce Agentforce is the agent layer Salesforce sells on the CRM data a company already has. HubSpot Breeze is HubSpot's set of marketing, sales and service agents. Intercom Fin answers customer support conversations.

Each of those is configured inside the product that hosts it, which works until a job spans two of them. A refund that needs both the help desk and the ledger belongs to no single suite.

Three first jobs and the clock each one runs on

Most teams start with three jobs, and the three differ in more than topic. Each runs on its own clock, needs its own connectors, and waits at a different point.

The sales job runs on a night clock and stops at the send. The finance job runs each morning and stops where money would move. The support job runs through the day and stops at the refund, which the support role's own grant list works through call by call. Those clocks are why one setting cannot cover the three: a product that gives every agent the same reach hands the month-end close whatever it hands the sales chase.

The same three jobs in one manifest

Here is the governance half of a project with those three jobs, in the format the kortix.yaml reference documents. An omitted grant resolves to none.

kortix_version: 2
default_agent: sales
connectors:
  - { slug: gmail, provider: composio, app: gmail,
      policies: [{ match: "get_*", action: always_run }, { match: "*", action: require_approval }] }
  - { slug: crm, provider: http, base_url: "https://crm.acme.example" }
  - { slug: ledger, provider: http, base_url: "https://ledger.acme.example" }
  - { slug: desk, provider: http, base_url: "https://desk.acme.example" }
agents:
  sales:   { file: agents/sales.md,   connectors: [crm, gmail],    secrets: none }
  finance: { file: agents/finance.md, connectors: [ledger, gmail], secrets: none }
  support: { file: agents/support.md, connectors: [desk, gmail],   secrets: none }
policy:
  default_mode: risk
policies:
  - { match: "gmail.send_email", action: require_approval, conditions: [{ arg: to, match: "*@acme.example", negate: true }] }

Read it in order. default_agent names the agent a session lands in when nobody picks one. connectors declares what exists, and its rule lets every get_* action run while every other Gmail action waits. The agents map is governance only, and the behavior behind each entry lives in its own markdown file with the prompt and the model. secrets: none keeps credentials out of the sandbox. policy holds writes for a person, and the one project rule holds a send to anyone outside the company domain.

The roles are lopsided on purpose. Sales reaches a CRM, Finance a ledger, Support a help desk, and all three share one mail connector. Nothing here grants a refund or a delete.

What your file changes against the vendor default

The vendor default is one reach for every job. Lindy states one approval sentence for the whole workspace, and a suite agent is configured once inside the product that hosts it. Your file can say something different for each row of the table above, and the difference shows up in what a job finishes without you.

Approval gates you set. Off until you set them. The file, not the tier, decides where the first month's incidents come from.

A grant is also editable outside review. A person who manages the project can change a rule in the dashboard or with kortix connectors policy set --apply, and a grant in the dashboard or by editing agents.<name>.connectors in kortix.yaml (connectors reference). Either takes effect on the default branch without a change request. Session work is the reviewed path: session work reaches main through a change request. Merge is default-deny for agents. Connector credentials are brokered server-side and never enter the machine. None of these edits moves a key.

Write these answers down before the pilot

• Which calls are reads. Naming them stops a team from gating a search that costs nothing to get wrong.
• Which writes need a name. A reply to an existing customer and a refund are both writes. Pick the one a person signs.
• Which arguments are out of bounds. A recipient domain, an amount ceiling, a customer tier. The project rule above is one line because the answer was one sentence.
• Who approves, and when they are awake. A held call waits, and a queue nobody watches is a slow outage.
• What the agent may never touch. Deletes, permissions, payroll. Blocked calls leave the queue for good.

Those answers decide the first month more than the per-task price you compared. One scoped agent outlives five running on a default.

Three posts go deeper on the parts this one leaves out. Secure AI agent tool access covers the credential boundary and the per-tool allow, ask and block mechanics. How to build reliable AI agent workflows covers what to do when a call fails anyway. If you are hiring, AI agents for HR puts the same question to one more role.

Try Kortix when you want the grant list in a repository rather than a console.