What started as one agent grew into a full team of specialists — each with a defined role, scoped tools, and a human approval gate before anything consequential.

Part of the Digital Ops Box Platform — the multi-domain operating system this agent layer runs inside.

The problem

I run a property-care business, a spa, and a consulting practice at the same time. There's a constant stream of small, repeatable work — invoices to draft, books to reconcile, content to prep, follow-ups to send — that doesn't really need me, but does need someone reliable who remembers the context and doesn't make a mess.

Hiring that out early didn't make sense. And a plain chat assistant forgets everything between sessions and has no accountability. I wanted something that could actually take work off my plate without me losing control of it.

Why it mattered

Anything that touches money, client data, or an outside system needs a human checkpoint. These tools can go on complete rampages trying to be helpful, and I told my full, dramatic experience with that in a separate article.

That said, "human in the loop" is the destination, not the starting point. Getting agents to actually do real things in the world requires defining the loop first — and defining the loop means running it before it's fully scaffolded. There's a construction analogy that fits pretty well: when you're setting the first beams on a bridge, someone has to walk out on that beam to unhook the cables from the crane. There's no safety net yet. You do it anyway, carefully, because that's the only way to build the structure that eventually makes the whole thing safe to cross. Getting agents to handle real operations is similar. The early stages involve some genuine exposure — a tool with too much reach, a loop that runs farther than intended, a decision made that you would have made differently. You learn from those, tighten the guardrails, and over time you end up with a system that earns the trust it's been given. The approval gate, the scoped tools, the deliberate decommission confirmations — those aren't bolt-on safety features. They're the scaffold you build as you go, beam by beam, until the thing can carry real weight without you standing on every piece of it.

What's running

It started with one agent — a chief-of-staff handling the connective tissue: routing tasks, holding context, checking in over Telegram. That was the whole plan. Then the work got more complex, the use cases multiplied, and specialists started making more sense than one agent carrying everything.

Now it's a team, each with a defined role and tools scoped to it:

• A chief-of-staff agent — routes tasks onto the board, holds long-running context across all the businesses, and checks in over Telegram. Saying "log a half hour on this client" is the whole interaction — it handles the entry.
• An agent-execution control layer — a specialized layer for execution-capable tasks with its own enable, pause, and abort panel. Separates work that can act on outside systems from everything else.
• A frontier-reasoning agent — called in for the reasoning-heavy work that benefits from a larger model: deep analysis, complex planning, multi-step research.
• A content and operations specialist — owns brand voice, client communications, and content prep for the spa side of the business.
• A content-and-planning agent on Hermes — Hermes is a separate platform running alongside OpenClaw, not inside it. It handles most of the content loops and planning work now; its self-learning and memory have been edging out the OpenClaw side for that kind of work, and the execution controls are tighter.
• A finance and market-research agent — runs daily chart analysis on a watchlist, brings buy/sell options to a morning review, and tracks the paper-trading engine's predictions against real outcomes to tune itself over time.
• Parallel coding agents — headless sessions for precise technical execution: follow a written plan, make the changes, report back. Several can run at once on different builds.
• Recurring loops for the operational work that should just happen without prompting.

Everything worth tracking shows up as a task or a Telegram message. Anything consequential lands in an approval queue before it runs. When an agent isn't sure how to categorize something, it doesn't guess — it asks and links the task. I approve or reject from my phone. Nothing irreversible happens silently.

What it's like now

The team has grown well past the original build. On a given day, applicants get scored, content gets drafted, rankings get checked, the calendar gets protected, and the books get reconciled — most of it before I've looked at any of it. The job shifted from doing the work to reviewing it.

Here's what's actually running underneath, area by area — pick one to see what happens inside it.

On the models, and what they're worth

For a long time I ran the agents on cheaper models to keep the bills down. I've changed my mind. When you put the hard parts on the larger models — Codex, Sonnet, Opus, even Gemini 5.4 — you stop hitting the walls the cheap ones throw at you: the confident wrong answers, the dumb mistakes, the loops that eat an afternoon. It costs more per month. But measured against what it replaces, it's a fraction of one employee's salary, and for that you can build real infrastructure into your business and your life that keeps paying you back. As the models improve and prices come down, this only gets easier.

Cursor ended up a bigger part of the stack than I expected. It gives me a coherent agent at what amounts to a subsidized rate on the larger models, which changes the math on leaning on them all day. It also runs background coding agents that grind on a build — sometimes slowly, sometimes needing a few passes to get it right — but they keep the infrastructure moving forward even when I'm not at the keyboard.

The result

A real amount of recurring work — bookkeeping, reconciliation, follow-ups, content prep, research — now happens with me reviewing instead of doing. Context stops getting re-explained every session. And because the irreversible steps always wait for approval, I actually trust it.

This isn't autopilot. It's a set of capable assistants with clear lanes and a human holding the keys.

What this applies to

Owner-operators carrying several businesses or domains at once, who have a steady stream of repeatable work but aren't ready to hire it out — and who want the safety of approving anything that touches money, clients, or live systems. Especially where keeping inference private and local matters.

What this approach unlocks

Once you're building on this layer, the website stops being a brochure. Web experiences that used to feel out of reach — real client flows, authentication, interactive tools — become something you can plan and ship. The same skill set lets you build the MCP tools the agents reach for, write the playbooks they follow, configure the agents themselves, and shape the UI so the agents and the environment actually fit together. The interface becomes the place where people and agents meet, not just a page someone reads.

Technical details

The agent team runs across three platforms:

OpenClaw hosts the chief-of-staff, the execution control layer, and the finance agent — running local inference on an NVIDIA DGX Spark (Llama 3.1 / Qwen 2.5 via Ollama) for routine work, reaching frontier APIs (Claude Opus, Sonnet, Codex, Gemini) when the reasoning calls for it.

Hermes is a separate agent platform running the content-and-planning agent — with tighter execution controls and stronger self-learning memory than the OpenClaw side. It runs alongside OpenClaw in the same environment but is independently managed.

Cursor provides the coding and execution agents — multiple headless sessions that can run in parallel, each following a task-scoped plan and reporting back on completion.

Coordination, tasks, approvals, and an append-only activity log live in Supabase; the dashboard is Next.js. Telegram handles mobile reach, approvals, and agent-to-operator notifications. Each agent is scoped with MCP tools that define exactly what it can and can't touch — specific tools for specific roles, not open shell access.

Approvals are what make the rest usable — the moment something irreversible runs without my say-so, the trust is gone.