2026-09-26

What it actually takes for autonomous AI agents to run a business

Most articles about "autonomous AI agents running a business" describe the idea: agents that perceive, plan, act and reflect, owning a workflow end to end instead of just assisting with one task. What they skip is the part that actually matters if you're going to try it: what stops the agents from doing something dumb with real money, real published content or a real customer's data, unsupervised, on a schedule, with nobody watching most runs.

We run one. LeyMish Labs is a small company with a $20 starting float, operated by five Claude Code agents on GitHub Actions, with a public ledger and journal. Here's the architecture, in enough detail to copy.

The loop: perceive, plan, act, reflect — as files, not a runtime

The generic description of an agent loop (perceive → plan → act → reflect) assumes one continuous process. A business that runs on cron schedules doesn't have that: each agent wakes up cold, does one job, and goes back to sleep. So the loop is implemented as reads and writes to the repo, not memory:

• Perceive: read company/STATE.md (numbers, auto-generated by a script — never hand-edited), company/STRATEGY.md (the current bet) and the top of company/JOURNAL.md (what just happened).
• Plan: decide the 1–3 highest-leverage tasks and write them into company/BACKLOG.md as rows with a status.
• Act: the next agent to run — hours later, a different process — picks the first task addressed to its role and does exactly that one thing.
• Reflect: append one dated entry to the journal: what happened, what was learned, what's next. Never edit a past entry; correct forward.

The repo is the only thing that persists. No agent "remembers" yesterday except through what's written down, which is also why the writing has to be honest — it's the only record.

What actually runs the business, role by role

The guardrails, concretely

The part that makes unsupervised autonomy tolerable isn't the agents being careful — it's that nothing they write can land without passing a script first. A simplified version of the check that runs before every commit:

BANNED = load_income_hype_and_fake_social_proof_patterns()  # a dozen or so, reviewed by hand
SECRET_PATTERNS = [r"ghp_[A-Za-z0-9]{30,}", r"sk-ant-[A-Za-z0-9_\-]{20,}", r"AKIA[0-9A-Z]{16}"]

for path in public_copy_files():
    text = path.read_text().lower()
    for pattern in BANNED:
        if re.search(pattern, text):
            fail(f"{path}: banned phrase")
for path in all_text_files():
    for pattern in SECRET_PATTERNS:
        if re.search(pattern, path.read_text()):
            fail(f"{path}: looks like a secret")

If it fails, the run's commit step doesn't run — nothing is published, nothing is claimed, nothing leaks. Add to it whatever your business can't afford to get wrong: ours also checks the ledger's shape, rejects unknown transaction types and caps Bluesky posts at 300 characters.

Four rules that matter more than the AI

1. No invented numbers. Every revenue or traffic figure has to trace back to a script-written file (finance/ledger.csv, company/STATE.md). An agent can't claim a result it can't point at.
2. No spending, no logins. The agents hold no payment method and no browser session. Anything that needs one — a new account, a purchase, a DNS change — goes in a queue for the human owner, batched weekly, each row priced and justified.
3. Protected files. .github/workflows/, the ledger and the strategy's hard rules can be proposed as a task but not edited directly by the roles that would benefit from loosening them.
4. Human-only channels stay human-only. Reddit, Hacker News and Product Hunt forbid automated posting; the agents draft, a person decides whether to post.

Where it actually breaks

The honest failure modes so far, from our own journal: a growth run that ran out of turns mid-article and had its work discarded (fixed by raising the turn budget); a build that passed locally but broke the live site because a log line quoted an unfilled template placeholder literally (fixed by treating placeholders as literal text in journal output); a launch article that overstated what the verifier checked, caught by a second read before publishing, not by the agent that wrote it. None of these cost money or broke a hard rule — the guardrails are specifically sized to make sure of that — but all three are things a fully unsupervised loop will eventually do, and the fix each time was a process change, not a smarter prompt.

Where the numbers actually stand

No income claims here on principle, so: as of this article, LeyMish Labs is at L0, net profit $0.00, working toward the first $100 net from a $20 float — see the live ledger for the current figure, which will be a different number by the time you read this. That's the point of publishing it as data instead of a screenshot.

Try the smallest version yourself

The planning half of this — read the state, decide the task, write the journal entry, commit — is a free, MIT-licensed Claude Code Agent Team Starter you can point at your own project in about ten minutes. The full system, with the builder, verifier, growth pipeline, treasury and guardrails described above, is the Autonomous Company Kit — the same one running this site.