TLDR: On July 14, Canva pushed Canva Code 2.0 to every account on every plan, free included. You describe a calculator, quiz, or scorecard in plain English, Canva builds the working thing, you edit it like any other design inside the editor where your brand kit already lives, and you publish it to a real URL. The interactive lead magnet, an asset that used to mean a developer invoice or one more monthly subscription, is now a prompt inside a tool your team already logs into. By the end of this you'll have a copy-paste prompt that turns the one question your leads keep asking into a working interactive tool, plus the pre-traffic check that catches the embarrassing failures before your audience finds them.

Three weeks ago I wrote about Canva folding the ad-refresh loop into a button, and the 30-minute test that shows whether a creative retainer still earns its invoice. I filed it under Zapier Optionality, the pattern where software you already pay for quietly absorbs a job you were paying somebody else to do, and I figured Canva was done collecting other people's invoices for the month.

It wasn't. On July 14, Canva made Canva Code 2.0 generally available to everyone, on every plan, free accounts included. You type a prompt, Canva generates a working interactive tool, a quiz that scores, a calculator that computes, a page that reflows on a phone screen, and then you edit the result like any other Canva design and publish it to a free Canva URL or your own domain.

The job getting absorbed this time is the interactive lead magnet, the calculator or scored quiz that used to sit behind a freelance developer, a Typeform-style subscription, or a "we'll scope it next sprint" conversation with an agency. If your lead capture is still a static download, the build cost excuse retired on July 14, and what's left is a decision about what to build.

Here's what shipped, what I'd build with it first, and the check I'd run before putting a dollar of traffic behind it.

• The July 14 change: Canva Code 2.0 went to every plan including Free, after a preview run that was gated to the first million users who found an easter egg at Canva Create in April.

• The Static Magnet: a PDF download tells you somebody wanted a file, a three-question calculator tells you what they're planning to spend.

• One prompt, one working tool: the full build prompt to copy, tuned for a lead magnet that solves one narrow job in under two minutes.

• The 10-minute pre-traffic check: what to test on your phone before this thing goes in a bio link or behind ad spend.

Who this is for: operators whose lead capture is a static download and whose booking page could use a warmer front door, which covers most call funnels, local service businesses, and agencies I talk to.

What Canva shipped on July 14

Canva Code launched in its first version last year, and Canva says users built more than six million coded sites with it, which told them the demand ran a lot deeper than developers. Version 2.0 arrived at Canva Create in April as a preview limited to the first million users who cracked an easter egg, and on July 14 it went to the full user base, per Canva's announcement and TechRadar's coverage of the general release.

The mechanics, per 9to5Mac's writeup: start from a plain-language prompt, one of 50-plus templates, or an HTML file imported from anywhere, including pages another AI tool generated. The output lands in the normal Canva editor, so you swap images by dragging from the library, change colors and fonts from the toolbar, click into any section and retype the text, and publish to a free Canva domain or a custom one, with responsive layouts and a mobile preview before it goes live. Canva's own line on it: "Canva Code sits inside the same intuitive editor where you already house your brand kit."

The part I'd flag for anyone who tried the first version and bounced: editing no longer means re-prompting the whole build. Canva spent the spring criticizing AI design tools for being AI-first and design-second, where the smallest tweak meant another prompt and an entirely new result, and the 2.0 pitch is that you fix the button color the way you'd fix it on a flyer. Danny Wu, Canva's Head of AI Products, framed the shift to TechRadar this way: "With the barrier to generating code lowered, the value has shifted to visual control: what you build needs to be distinctive and look like your brand or vision."

Canva also reports generation time down 75%, median prompt-to-publish time down 30%, and active Code users up 25% since the feature moved into the main UI. Worth holding loosely: every one of those is Canva measuring Canva. The Crescitaly team's read matches mine: "Treat speed as production capacity, not business impact." Faster builds mean you can test more ideas, and they prove nothing about whether any given idea converts.

The Static Magnet

Here's the name for the thing this replaces. The Static Magnet is the PDF checklist, the swipe file, the ebook that captures an email and then tells you nothing else about the person who grabbed it, because it asked them to do nothing except download, and an asset that asks for no decisions collects no intent. Every download looks identical in your CRM, the tire kicker and the operator with budget land in the same nurture sequence, and your follow-up is generic because the asset gave you nothing to personalize with.

An interactive asset works the opposite job. A three-question calculator makes the reader type in their monthly ad spend, their average deal value, their close rate, and now the "lead magnet" has handed you qualification data before a single email went out. A scorecard makes them self-assess, and the score tells you who's ready for a call this week versus who needs three months of nurture. Crescitaly's framing of why this works on social traffic is the cleanest I've seen: an interactive asset turns a fast scroll into a small decision, and a small decision reveals real intent.

I sell from behind one of these myself. The AI IQ Test is a scored quiz, and the value over a PDF is the same value I'm pointing you at here: the answers tell me where an operator stands before I've written a single follow-up, so the follow-up gets to be specific instead of generic. That asset was a real build project when it went up. As of this month, the same category of asset is a prompt.

Pick the job before the format

The move: find one question your audience already asks on repeat, and build for that question only. Go mine the places the questions already live: your DMs, your sales call recordings, your inbox, the comments on whatever post performed best this quarter. You're looking for a question with commercial weight behind it, the kind where the answer changes what somebody buys.

The mapping (adapted from Crescitaly's planning model, which mostly matches how I'd sort it):

"How do I even start with X?" on repeat  ->  guided checklist, outputs a personal action plan
"Should I do X or Y for my case?"        ->  3-question decision quiz, outputs a recommendation
"What would this cost / return?"         ->  simple calculator, outputs a planning range
"Are we ready for X?"                    ->  scorecard, outputs a gap read that earns the audit call

What a correct pick looks like: you can write the result as one sentence before you build anything. "You're leaving roughly $X on the table from no-shows every month" is a buildable result, and so is "Your setup scores 6 out of 10 on AI readiness, here are the two gaps." If the result needs a paragraph, the tool is too broad.

The failure mode: picking a format because it demos well. A gorgeous interactive experience wrapped around a question nobody was asking converts worse than the ugly PDF it replaced, because at least the PDF answered something. Format follows question, every time.

Walk away with: one repeated audience question and a one-sentence result definition, written down before you open Canva.

The build prompt

The move: open Canva, start a Code build, and paste this with your blanks filled. It's structured to force the constraints that make lead magnets convert, few inputs, fast result, one call to action.

Build a [FORMAT: calculator / 3-question quiz / scorecard] for
[WHO: e.g. agency owners who book sales calls from paid traffic].

The one job: answer "[THE QUESTION YOUR LEADS KEEP ASKING]"
in under 2 minutes.

Inputs: no more than [3-5] fields.
[LIST THEM: e.g. monthly ad spend, average deal value, close rate.]

Logic, in plain English:
[e.g. booked calls = ad spend / cost per booked call.
Revenue = booked calls x show rate x close rate x deal value.
Show the gap between their current number and a 75% show rate.]

Result screen: one sentence in this exact shape:
"[THE SENTENCE THE USER WALKS AWAY WITH, number filled in.]"
Below it, one button labeled "[CTA TEXT]" linking to [URL].

Style: [BRAND COLORS + FONT], mobile first, large tap targets,
no intro screen, no email gate before the result.

Do not include: fake precision (round all outputs), disclaimers
longer than one line, or any input field I did not list above.

What a correct output looks like: a working preview you can poke at inside the editor, where the math holds when you test it against numbers you already know, and where the branding swap takes minutes in the toolbar instead of another generation. Under the hood Canva's code generation runs on Anthropic's Claude models, per vibecoding.app's review, and simple bounded logic like this is squarely inside what it does well.

The failure mode: the first generation comes back generic or the logic bends somewhere. The fix is scoped follow-up prompts aimed at one element, "the result rounds to the nearest hundred," "make the second question a slider," rather than regenerating the build. And check the arithmetic by hand with two known scenarios before you trust it, because a calculator that's wrong is worse for your credibility than no calculator.

Walk away with: a working, on-brand interactive tool built from one prompt and a handful of scoped edits.

The 10-minute pre-traffic check

The move: before the link goes in a bio, an email, or an ad, run this check start to finish. Interactive assets have more ways to break than an image, and the failures are public.

THE 10-MINUTE PRE-TRAFFIC CHECK

1. Run it on your phone, then somebody else's phone.
   Thumb-only, no pinch-zooming required.
2. Feed it garbage: zeros, blanks, a $999,999,999 budget.
   It should fail politely. No crashes, no "NaN."
3. Read the result screen out loud. A planning aid reads
   like a planning aid. If it sounds like a guarantee,
   soften the copy.
4. Click every button. The CTA lands where it claims,
   with your tracking parameters intact on the URL.
5. Time a cold run, open to result. Over 2 minutes,
   cut an input field.
6. Confirm where responses land (Canva Sheets can collect
   form responses) and that a named human checks it.
7. Ask: does the result state what data is stored and
   keep the email field optional? Never collect more
   than the follow-up needs.

What a correct output looks like: a stranger on a phone gets from your post to a useful, honest result in under two minutes, and you can see the completion in your response sheet with enough context to write one specific follow-up line.

The failure mode: shipping on desktop-preview confidence. Nearly all of this traffic is mobile, and the version of you that built the thing is the worst possible QA tester because you already know how it's supposed to work. Hand your phone to someone who's never seen it, and watch where their thumb hesitates.

Walk away with: a tested link you can put spend behind without wincing.

Where this goes wrong

The novelty build. The tool exists because the builder was excited, so it answers no recurring question, and it gets impressive engagement from people who were never going to buy. The control is boring and useful: Crescitaly's team suggests keeping the same offer live as a plain page or PDF, and giving the interactive version more budget only if it wins on qualified action.

The twelve-field intake. Somebody on the team wants "just one more question" until the calculator turns into an application form, and completion rate falls off a cliff. A social click is fragile, the result has to arrive before the patience runs out.

The overcertain score. A marketing scorecard that reads like a diagnosis creates trust problems and, in some industries, compliance problems. Round numbers, hedged language, one-line honesty about what the tool can't know.

The orphaned inbox. Responses collect in a sheet nobody owns, and the hottest lead of the month sits unanswered for nine days. The asset is the cheap part, the follow-up system it feeds is where the revenue is.

The honest tradeoffs

This is a widget engine, and the ceiling is real. Everything runs client-side, so there's no user login, no database behind it, and nothing that needs server logic, which rules out anything past a bounded tool. The vibecoding.app review puts it plainly: "You cannot build apps. You cannot export code." Your build lives inside Canva's ecosystem, HTML comes in but doesn't come out, and that matters if you ever want to move the asset somewhere Canva isn't.

AI credits meter the whole thing, shared across Canva's other AI features, and free accounts get the tightest limits, so a heavy build week can hit the ceiling before the month resets. The speed and adoption numbers are Canva's own measurements with no independent audit. And generated logic still deserves a human check every time, one operator-focused review put the risk well: "Generated code may contain weak logic or hidden errors," and "publishing speed can discourage proper review." For a prototype or a lead magnet, none of this is disqualifying. For checkout flows, client portals, or anything holding sensitive data, this is the wrong tool and a real developer is still the answer.

Recap

Canva Code 2.0 went to every plan on July 14, which moved the interactive lead magnet from a build-cost decision to a judgment decision. The judgment part: mine your DMs and sales calls for one repeated question with money behind it, define a one-sentence result, build the smallest version with the prompt above, run the 10-minute check on a phone that isn't yours, and measure it against your existing static download on qualified action, keeping the winner. The Static Magnet era of lead capture didn't end because PDFs stopped working, it ended because the thing that outperforms them stopped costing anything to try.

If you want to feel the difference from the lead's side before you build one, take the AI IQ Test. It's a scored quiz I run in front of my own offers, it takes about three minutes, and you'll see the mechanics from the receiving end, the bounded inputs, the specific result, the one next step. Steal the structure for your own.

Reply with the one question your leads keep asking you, and I'll tell you which format I'd build for it.

Andrew

P.S. If you're building this week: the 30-minute Canva Grow test covers the ad-creative side of the same absorption pattern, Zapier Optionality is the original writeup on software eating its neighbors' invoices, the three-prompt Google Business Profile check does the same commoditization math on listings retainers, and the full archive lives at muddventures.substack.com.

This newsletter gets drafted on a Claude scheduled task before I'm awake, so when Anthropic swaps the engine that kind of work runs on, I feel it the same morning without touching a setting. That swap happened Friday. Claude Opus 5 shipped on July 24 as the new default on Anthropic's top plans, at the same price as the model it replaced, and most of the people paying for those plans will never open the announcement.

That's one of three changes from the last seven days worth an operator's attention, and none of the three got the coverage the model-leaderboard drama usually pulls. By the end of this you'll have a two minute privacy check to run on your own AI account, a test for deciding which written-off tasks deserve a rerun, and a read on what HubSpot moving agents into the CRM means for software you're already paying for.

Here's what's in this one:

• The daily-driver model got smarter at the same bill. Opus 5 replaced Opus 4.8 on Friday at identical pricing, and the right response is rerunning old failures, no new subscription involved.

• HubSpot gave agents one home inside the CRM. Agent Hub and Agent Builder went to public beta for every Professional and Enterprise account on July 23.

• Shared Claude chats showed up in Google results. Fixed within days, and the two minute cleanup is still worth running today.

The upgrade you already paid for

Anthropic released Claude Opus 5 on July 24 at $5 per million input tokens and $25 out, the same sticker as Opus 4.8, the model it replaces. Anthropic's own line is that it lands close to Fable 5, the company's most capable public model, at half the cost, and it's now the default on the Max plans and the strongest option on Pro. The full breakdown with benchmark tables is in tech-ish's launch coverage.

Two numbers in the launch material matter more for operators than any leaderboard placement. On AutomationBench, a test of whether a model can carry an ordinary business task from start to finish, Opus 5 passed 26 percent, against 18.1 percent for OpenAI's GPT-5.6 Sol. Zapier CEO Wade Foster says it topped Zapier's own automation leaderboard and cleared a customer-churn task no previous model had passed. Read those two together and the picture is that the best model on the market still completes about a quarter of ordinary business tasks end to end, which is why every issue in this series keeps landing on the same design: bounded jobs, human checkpoints, the Book Line and its cousins.

Here's the operator move, and it has nothing to do with switching tools. Somewhere in your head is a list of jobs you handed an AI in 2025 that came back wrong, the messy spreadsheet cleanup, the proposal draft that missed the point, the report that invented a number, and each of those failures hardened into a conclusion about what AI can't do. I call that conclusion The Stale No. Model capability moves every few months, your conclusions mostly don't, and a no you collected from a model two generations back is expired evidence you're still acting on.

When the default engine in a tool you already pay for gets a real jump, upgrade day is the day the Stale No list gets rerun. Write the list down this time:

MY STALE NO LIST

Tasks I tried with AI that failed, with the date I gave up:
1. [task] - [month/year] - [what went wrong, one line]
2. [task] - [month/year] - [what went wrong, one line]
3. [task] - [month/year] - [what went wrong, one line]

Rerun rule: when the model behind my main AI tool gets replaced,
rerun the top 3 with the same inputs I used the first time.
Keep the output only if I can verify it in under 5 minutes.

Worth flagging: every benchmark figure above is Anthropic's own run, no independent numbers exist yet, and requests that trip a safety filter quietly fall back to the older Opus 4.8, so some of what you get on any given day is still the previous model. The rerun costs you twenty minutes either way, and the worst case is confirming your no is still fresh.

HubSpot gave its agents one home

HubSpot launched Agent Hub and Agent Builder in public beta on July 23, live now for every Professional and Enterprise account. Agent Hub is one screen showing every agent running across marketing, sales, and service, live status and performance included, and Agent Builder lets you describe an automation in plain language and have it built against the deal history, contact records, and call transcripts already sitting in your CRM.

The problem it targets is real. HubSpot product chief Duncan Lennox describes what happens once a team runs more than one agent: "they become fragmented, all working from different pictures of the customer, or even worse, no picture at all." A prospecting agent emails an account the same week a service agent is handling that account's open complaint, and neither knows about the other. If you run HubSpot, the pattern I'd copy comes from the launch customer: Ignite Reading, a tutoring program operating across 25 states, pointed Agent Builder at one narrow grunt task, parsing each school district's academic calendar, and turned a 15 to 20 minute chore into seconds, north of 350 hours a year back. HubSpot picked that story for the press release, so hold it loosely, but look at its shape: bounded, verifiable, zero customer contact.

The skeptical read comes from Gartner's Kathy Ross, talking to CX Today: "They're very powerful tools, but they're not employees, they're not teammates, and they have to be managed like technology." A human rep having a bad day affects a handful of conversations, a misfiring agent reaches your whole list before anyone looks up. Which is why the first agent to turn on is one whose mistakes stay inside the building, and why the access question from the Anthropic security piece applies here word for word: what can this agent touch, and whose login is it borrowing to touch it.

The 2-minute check on your shared AI chats

Over the weekend, Reddit users found that a Google search along the lines of site:claude.ai/share surfaced long lists of publicly shared Claude conversations and Artifacts. Futurism found "a detailed medical report of a real patient, clinical trial results that included patient names," and company documents marked internal-use-only in the exposed set. Anthropic's position, via spokeswoman Amie Rotherham: "When someone shares a conversation, they are making that content publicly accessible, and like other public web content, it may be archived by third-party services." By Monday afternoon the search results were gone, per TechCrunch's own testing.

The fix on Anthropic's side landed fast. The lesson on your side is permanent, and it applies to every AI tool with a share button: a share link is a publish button with a delay on it. The chat you sent a client in March with your pricing logic in it, the thread you shared with a contractor that had customer names in it, those are public web pages, and whether they stay obscure depends on nobody ever posting the URL anywhere a crawler can see it. ChatGPT went through its own version of this last year, when a researcher scraped around 100,000 shared conversations that had been set public.

Run the cleanup now:

THE SHARE-LINK AUDIT (2 minutes)

Claude:   Settings -> Privacy -> Shared Chats
          Delete every link you don't have a live reason to keep.

ChatGPT:  Settings -> Data Controls -> Shared Links
          Same rule. If you can't name who still needs it, kill it.

Going forward, one question before sharing any chat:
"Would this page be fine showing up in a Google result
with my name on it?" If no, copy the text into a doc instead.

Where I'd start

Ranked by effort against payoff: the share-link audit is two minutes and closes a real exposure, so it goes first, today. The Stale No rerun is twenty minutes this week, and it's the one most likely to hand you a working automation you'd already paid for and walked away from. The HubSpot pilot is for HubSpot shops with an hour to spare, one bounded internal task in Agent Builder, mistakes that stay inside the building, then a look at Agent Hub's performance screen after a week to see what the thing did while you weren't watching.

I've used AI every working day since February 2023, and weeks like this one are the argument for running a system instead of a scramble: the tools underneath you upgrade themselves, sprout agents, and spring leaks whether you're watching or not. Keeping up turns out to be a set of small habits, a list you rerun, a settings page you check, a pilot you scope deliberately small. Inside the Abra AI community that's the standing conversation, operators comparing what cleared their own Stale No lists and which agent pilots earned a second week, and the skill files behind this newsletter's own automation live there too.

Recap

Opus 5 replaced Opus 4.8 at the same price on July 24, so rerun the tasks you wrote off instead of shopping for new tools. HubSpot put agent building and agent monitoring inside the CRM on July 23, and the first agent worth turning on is one whose mistakes can't reach a customer. And your shared AI chats are public web pages, so spend the two minutes deleting the ones that have no reason to exist.

Reply with the one task you wrote off as too much for AI in 2025. I want to see how many of those come back from the dead this quarter.

Andrew

P.S. Three related builds from the archive: the 4-question agent access check borrowed from Anthropic's own security team, the calendar workflow with the Book Line built in, and the three-prompt Google Business Profile check. The full archive lives at muddventures.substack.com.

TL;DR: Zapier moved AI steps to model-tier pricing on June 15, and the doc got a fresh update on July 15. Standard models bill 1x tasks, Advanced bills 3x, Premium bills 5x, and every tool call inside the step multiplies at the same rate, so one AI step can burn 15 tasks in a single run. The detail most people will miss: every new AI step defaults to the 3x tier. Below is the billing formula with worked math, a 15-minute audit for every Zap you run, and the two lanes that bring a step back down to 1x.

I read Zapier's updated AI pricing doc this week, the one they refreshed on July 15, and the thing that stopped me sits in a dropdown. When you add an AI step to a Zap, the model tier ships preset to Advanced, which bills three tasks per run before you've typed a single word of your prompt. Standard is right there in the same menu at one task. Nobody's hiding it, the tiers are printed in the selector, and the markup still collects from everyone who never opens the menu, which is most people, because defaults are where software makes its quiet money.

By the end of this you'll know what every AI step in your Zaps costs per run, and which steps can move to a 1x lane without losing anything.

The dropdown doing the billing: every new AI step ships set to the 3x tier, and that setting rides along until somebody opens the menu.

The formula worth memorizing: one run costs (1 x model rate) + (tool calls x model rate), which is how a single step reaches 15 tasks.

The two 1x lanes: simple judgment jobs run at 1x on Standard, and your own API key runs tool-heavy steps at 1x too.

Where the meter can't reach: filters, paths, and formatter steps bill zero tasks, so rule-based work costs nothing once you move it out of the AI step.

I ran the numbers on what that dropdown costs at volume, and this issue is that math. It's the same invoice logic I walked through on the Canva retainer test: the vendor publishes the honest price sheet, and the gap between what you pay and what the job requires lives in a setting nobody audits. I'm calling this one The 3x Default, the pattern where a platform sets its pricier tier as the preselected option on every new AI step, and the difference quietly compounds across every run of every Zap you've got.

Who this is for: operators running Zapier on a Professional or Team plan with at least one AI step in production, and anyone whose task bill has been creeping without an obvious reason.

How the new meter works

Zapier switched AI steps to model-tier pricing on June 15, and the full pricing doc lays out the tiers. Standard models like GPT-5 mini and Gemini 2.5 Flash bill at 1x and can't call tools. Advanced models like Claude 4.5 Haiku and Gemini 2.5 Pro bill at 3x and can. Premium models like GPT-5.4 and Claude 4.8 Opus bill at 5x. Bringing your own API key bills at 1x no matter what it's doing, and that lane is going to matter in a minute.

The formula is the part worth writing on a sticky note:

Tasks per run = (1 x model rate) + (tool calls x model rate)

Standard, no tools:        (1 x 1) + (0 x 1) = 1 task
Advanced (the default):    (1 x 3) + (0 x 3) = 3 tasks
Advanced, 1 tool call:     (1 x 3) + (1 x 3) = 6 tasks
Premium, 2 tool calls:     (1 x 5) + (2 x 5) = 15 tasks
Your own key, 4 tool calls: (1 x 1) + (4 x 1) = 5 tasks

Those aren't my estimates, they're Zapier's own worked examples from the pricing doc. A tool call is any time the step successfully reaches into an app or a knowledge source during a run, so an AI step that checks your CRM and then writes to a sheet is carrying two multiplied calls on top of its base rate.

What the right read looks like: you can name the per-run cost of every AI step you have. The failure mode is assuming an AI step still costs one task the way it did before June 15, because a Zap that was cheap in May can be billing at triple or better in July with zero changes on your end, and legacy steps built before June 15 run under their own rules now too, including a June 30 pause on older Standard-model steps that used knowledge sources.

Walk away with: the formula and your own per-run number for each AI step, written down.

The 15-minute audit

The task meter is where this gets real. On Zapier's Professional annual plan, $19.99 a month covers 750 tasks, and eesel's breakdown of the billing pages puts 10,000 tasks a month at roughly $300, with overages billing at 1.25x your base rate once you blow through the cap. An operator on r/aiagents posted his own invoice math in February: $847 for one month, an 8-step lead-capture flow, 100 leads a day, 24,000 tasks a month, and his conclusion is the part I'd frame: "The worst part is you start optimizing for Zapier's pricing instead of what's best for your business. I caught myself removing steps from workflows just to save on task counts."

That was before model multipliers existed. Under the new meter, the same reflex points somewhere better: stop deleting steps and start checking tiers. Here's the audit, and it runs in about 15 minutes for a normal-sized account:

THE 3X DEFAULT AUDIT

1. Open each Zap that contains an AI by Zapier step.
2. For each AI step, write down three things:
   - Model tier (open the dropdown: Standard / Advanced / Premium / own key)
   - Number of tools attached to the step
   - Roughly how many times the Zap runs per month (Zap history shows this)
3. Compute per-run cost: (1 x rate) + (tool calls x rate)
4. Multiply by monthly runs. That's the step's monthly task burn.
5. Rank your AI steps by burn, highest first.
6. For the top of the list, ask one question:
   does this step use tools, and does it require deep reasoning?
   - No tools + simple job (summarize, classify, extract) -> test Standard at 1x
   - Tools attached -> test your own API key at 1x
   - No judgment in the job at all -> move it out of AI entirely (free steps below)

A worked example, because the abstraction hides the money. A lead-summary step on the untouched default tier with two tool calls costs nine tasks a run, and at 30 leads a day that's about 8,100 tasks a month from one step, which is most of the way to that $300 pricing band on its own. The identical step running through your own API key costs three tasks a run, about 2,700 a month. If the job doesn't use tools at all, Standard runs it at one task, roughly 900 a month. Same Zap, same output, three very different invoices.

What the right output looks like: a ranked list where the top two or three steps explain most of your AI task burn, because that concentration is what makes the fix fast. The failure mode is auditing one Zap and calling it done, when the whole reason this compounds is that the default rides along on every AI step you or your team has added since June 15, including the duplicated ones sitting across client accounts.

Walk away with: a ranked list of your AI steps by monthly task burn, and a downgrade candidate circled.

Moving a step down without breaking it

Downgrading a tier is a thirty-second edit, and the tier menu lives right on the step, so the real work is proving the cheaper tier holds quality. Zapier's own Steph Spector put the target well in the company's cost guide: "your goal is to value-maxx, not token-maxx," and the same post notes "you pick the tier that matches the job, and you can swap models anytime without rebuilding anything." Run the proof before you commit:

TIER PARITY TEST

Take the last 5 real inputs this AI step processed (pull from Zap history).
Run them through the step twice: once on the current tier, once on the cheaper one.
Compare outputs side by side and ask:
- Did the cheaper tier follow the format instructions?
- Did it catch the same key facts?
- Would the downstream step (CRM write, Slack ping, sheet row)
  behave identically with this output?
5 for 5 -> downgrade and note the date, then spot-check in a week.
3 or 4 of 5 -> tighten the prompt and rerun before deciding.
Under 3 -> the step earns its tier, leave it and move down your list.

Three lanes, in order of how often they pay off. First, the judgment jobs that touch no tools, the summarize-classify-extract work that makes up most AI steps I come across in real accounts, and those run on Standard at 1x more often than people expect. Second, the tool-heavy steps, where connecting your own OpenAI or Anthropic key drops the multiplier to 1x, and yes the token bill lands on your API account instead, but for a step making a handful of calls per run the math usually lands well under the 3x and 5x task rates. Third, the jobs with no judgment in them at all, the routing and reformatting and if-then work, and those belong outside AI steps completely, because Zapier's filters, paths, and formatter steps bill zero tasks, which means every rule you move out of a prompt and into a path is billing that drops to nothing.

What the right result looks like: same outputs downstream, smaller number on the meter, and a one-line note in your ops doc saying which steps run on which tier and why. The failure mode is dropping a tool-connected step to Standard, because Standard can't call tools at all, so the step doesn't get cheaper, it stops doing part of its job, and that's a break you might not notice until the CRM rows stop appearing.

Walk away with: at least one step moved to a 1x lane with a parity test behind it, and the rule-based work headed out of AI steps entirely.

What's still true on Zapier's side

The default isn't a scam, and the tradeoffs deserve daylight. Advanced is the default because tools require Advanced or better, and Zapier presumably decided a new step that can use tools out of the box beats a new step that errors when you attach one. There's also a real protection built in: if a single run hits 75 tasks, the Zap pauses and asks for approval before it keeps spending, which is more of a circuit breaker than most AI billing systems give you.

The bring-your-own-key lane carries its own homework, since you're now managing API keys and watching a second bill, and the insulation cuts both ways: on Zapier's included models your cost per run stays fixed no matter what token prices do, which is worth something. Sara McNamara, a Zapier partner, has made the case that the per-task model is genuinely predictable once you understand it, and that for teams with compliance needs and SLAs, predictability can matter more than raw cost per action. She's right about the predictability, and the audit above is how you make the predictable number a smaller one.

Two more honest flags. My dollar figures are directional, because your per-task price depends on where your plan sits on Zapier's task slider, so run the math against your own bill, and note that Zapier's claim of roughly $1,300 in tokens for a thousand form submissions run through a chat assistant is Zapier's own benchmark measurement, not an independent audit. And the whole AI-step system sits on Professional plans and up, with tool calls not yet available on Enterprise accounts at all, which is a strange gap for the most expensive tier.

Failure modes

The audit dies in four predictable places. Checking tiers on three Zaps and skipping the client sub-accounts where the duplicated flows live. Downgrading a tool-connected step to Standard and breaking it silently, covered above, run the parity test. Treating the own-key lane as free when it moves cost to your API bill instead of erasing it, so compare both invoices after a week. And doing the audit once, in July, when the default reapplies itself to every AI step anyone on your team adds from here forward, so put a monthly fifteen-minute recheck on the calendar next to your task-usage email.

Recap

Zapier's AI steps now bill by model tier, 1x, 3x, or 5x, tool calls multiply at the same rate, and the default on every new step is 3x. The formula is (1 x rate) + (tool calls x rate). The audit is: list your AI steps, log tier and tools and monthly runs, rank by burn, then move what you can to the 1x lanes, Standard for simple no-tool jobs, your own key for tool-heavy ones, and free deterministic steps for anything with no judgment in it. Test parity on five real inputs before committing, and recheck monthly because The 3x Default resets with every new step.

This kind of audit is a slice of what I look at when an operator wants their whole AI spend mapped against what the work requires, and if you want a second set of eyes across the full stack rather than one tool, that's a fit for an AI Clarity Call at muddventures.com/book.

Reply with your monthly task number if you know it off the top of your head, most people don't, and that's sort of the point.

Andrew

P.S. More from the archive on the same money trail: the 30-minute Canva test for your ad creative retainer, the 4 questions to run before an agent gets access to your systems, the calendar workflow with the one job AI never runs alone, and the full newsletter archive at muddventures.substack.com.

I spent years on the sales and marketing side before going all in on AI, and one play showed up in every growth playbook I ever touched: teach something real for free, fill the room, and let the product do the selling from the front of it. A week ago today, OpenAI started running that play on small business owners at a scale no agency could touch.

On July 21 they launched the ChatGPT for small business program: free virtual trainings, in-person AI academies across the US, guides built to load straight into ChatGPT, and partner offers from Shopify, Intuit, Dropbox, Slack, Atlassian, and Wix. I read the announcement twice, once as an operator who'll take useful free training from anybody, and once as a guy who used to build funnels like this for a living, and both reads land in the same place: sign up, and walk in holding your own agenda.

By the end of this you'll know which pieces of the program are worth your time, why it exists at all, and the one-page agenda that turns a vendor demo into a workflow you leave with.

The useful parts are free and live right now. Webinars, in-person academies, uploadable guides, and partner deals, all linked below.

The reason it exists is on the record. 95% of ChatGPT's 900 million weekly users pay nothing, and OpenAI's CFO has been open about growing the business side ahead of an expected IPO.

Their own number sets the bar. OpenAI says 78% of last year's AI Jam attendees built a working workflow in a single day, so show up planning to be in that 78%.

The agenda you bring decides which side of that number you land on. There's a fill-in block below to complete before you register.

What went live on July 21

The program has four pieces. Hands-on virtual trainings, product webinars showing ChatGPT Work running day-to-day small business jobs across accounting, marketing, and ecommerce, with prompts to take home and partner Q&As. In-person AI academies, run by the OpenAI Academy team in cities across the US, local owners in a room doing guided exercises together. New guides and customer stories, including interactive ones you upload straight into ChatGPT to start a workflow. And a curated set of partner tools and offers from Dropbox, Shopify, Intuit, Slack, Atlassian, and Wix, built around common small business workflows.

All of it points at ChatGPT Work, the agent OpenAI shipped July 9 alongside GPT-5.6, built to run multi-step jobs end to end once you connect it to your files, your apps, and your way of working. The same day the program launched, OpenAI said ChatGPT Work and Codex crossed 10 million combined users, double what Codex alone had earlier in July. The push is working, and small business is the next room they want to fill.

The trade underneath the free training

None of this is charity, and OpenAI hasn't pretended otherwise. CFO Sarah Friar told the AP earlier this year that 95% of ChatGPT's 900 million weekly users pay nothing, the company is still unprofitable at an $852 billion valuation with an IPO expected, and business customers already drive about 40% of revenue. TechRadar's read on the launch was blunt: "The scheme is primarily an education process", and small businesses represent around 99% of the private sector, which is a lot of unopened wallets.

There's a name worth putting on this, because you're going to see a lot more of it: The Vendor Classroom. Free training a platform runs where the tool is the teacher, the syllabus, and the sales pitch at the same time. I watched versions of this play from the inside for years, a free workshop that teaches something real is one of the oldest pipelines in marketing, and the people who get the most out of one are always the ones who show up with a specific problem to solve before the pitch ever starts.

Also, my verdict up front: the trade is fine. Agencies charge four figures for worse training than a platform gives away when it wants your workflows living inside its product. The price you pay in a Vendor Classroom is your attention becoming pipeline, and attention is a cost you can manage.

What I'd grab this week

Three pieces are worth moving on.

First, the in-person academies if one lands near you. The screen-share webinar you can get anywhere, a room full of local owners comparing what they've automated is much harder to find, and OpenAI's own numbers from last year's Small Business AI Jams say 78% of participants built a functional AI workflow in a single day and 42% saved more than five hours a week afterward. Those are vendor-measured numbers, more on that below, but even discounted they describe a working format: hands on, one day, leave with something running.

Second, the webinars, on the condition that you register with a job already picked. This is where the agenda comes in. Fill this out before you sign up, it takes ten minutes and it changes what you get out of every session:

MY WALK-IN AGENDA (fill out before any webinar or academy)

The three tasks I repeat every week that eat the most time:
1.
2.
3.

The tools those tasks touch (name them, e.g. QuickBooks, Gmail, Shopify):

The one task I want built and running before the session ends:

What "working" looks like for that task (the output I can check):

My question for the Q&A: what does this workflow read and touch
in my accounts, and can I run it in a review-first mode?

The right output from a session is one of your three tasks running as a workflow you can rerun tomorrow without the instructor. The failure mode is the spectator run: ninety minutes of nodding at demos of businesses shaped nothing like yours, a notebook full of screenshots, nothing built. Their own 78% stat says building in one session is the norm, so hold them to it.

Third, the partner offers. There are promos from Dropbox, Shopify, Intuit, Slack, Atlassian, and Wix attached to the program, and if you already pay for any of those, ten minutes checking the offer list against your current bills is the easiest win on this page.

Walk away with: one of your three weekly time-eaters running as a ChatGPT Work workflow, built during their free session, on your data, checked against your own definition of working.

What to keep your eyes on

An honest list, because the announcement won't give you one.

The stats are the vendor's own. The 78% and 42% numbers come from OpenAI measuring OpenAI's event, no independent audit, and the customer quotes on the launch page are hand-picked. One of them still caught my attention because it's specific: Kevin English, who owns a construction business called Keg Built, says "On one 30-page contractor quote, ChatGPT saved me at least 10 hours of data entry". Specific task, specific document, specific hours. That's the shape of claim worth testing on your own quotes and invoices, and the shape worth writing down about your own results.

The syllabus teaches the tool. Nobody in a Vendor Classroom is going to map your sales process or tell you which of your workflows would be better left alone, the curriculum optimizes for ChatGPT Work adoption because that's what it's for. The academies will show you what the tool can do, your business is on nobody's syllabus but yours.

ChatGPT Work wants access to run. The whole premise is an agent connected to your files, email, and apps, and connection questions deserve more thought than a workshop signup form. I wrote up the four access questions worth asking before any agent gets into your accounts in the Anthropic security piece last week, and they apply to OpenAI's agent the same way.

The app under all this is still settling. OpenAI replaced its desktop app this month with a version built on Codex, and 9to5Mac notes the change added complexity to the basic chat interface, with a few updates since trying to rebalance chat against tasks. Expect some interface churn while you're learning.

THREE QUESTIONS FOR ANY VENDOR CLASSROOM

1. Can I build this on the plan I already pay for, or does the
   demo assume a bigger seat?
2. What does this workflow read and touch in my accounts, and
   can I run it read-only or review-first to start?
3. When the model underneath changes, does my workflow keep
   working, and how would I find out?

The short version

OpenAI built a free national training program because it wants small businesses running workflows inside ChatGPT Work before the IPO, and both halves of that sentence can be true at once: the training is real and the motive is revenue. Sign up for the program, pick an academy date if one's close, and fill out the walk-in agenda before you register, because the difference between extracting value from a Vendor Classroom and becoming its pipeline is whether your agenda or theirs runs the session.

Also, before you sit in anyone's classroom it helps to know where you stand. The AI IQ Test takes a few minutes and scores how your business is using AI today across marketing, ops, and sales, so you'll know which sessions are worth your seat.

Reply if you register for one of the academies, I want the field report on what they teach when the press isn't in the room.

Andrew

P.S. More from the archive worth pairing with this one:

• The four access questions before any agent touches your accounts: 4 questions Anthropic's security team runs

• The 5,000-character brief that stops you re-explaining your business in every AI chat: The Standing Brief

• The calendar workflow that hands AI the grunt work and keeps the confirm human: The Book Line

• Skill files and prompts from these issues live in the Abra AI community

• Full archive: muddventures.substack.com

TLDR: Google’s “Help me schedule” in Gmail and the Claude Google Calendar connection both read your live availability and propose meeting times for you, and that whole find-times-and-draft-the-proposal job is safe to hand over end to end this week. The one job to keep human is the confirm, the moment a meeting books onto someone’s calendar. I call that boundary The Book Line. Below is the prompt that hands off the grunt work, the guardrail that holds the line, and the failure modes that show up when operators let the AI cross it.

A consulting client I worked with last year ran a small closing team, and the thing that ate their week wasn’t the calls, it was the back-and-forth to book the calls, the “does Tuesday work, no how about Thursday, mornings are better for me” chain that ran ten messages deep before a single meeting landed on anyone’s calendar.

The number that jumped out when I pulled it apart was the time cost, their setters were spending close to an hour a day just trading times, and none of that hour touched revenue. If you’re running any kind of booked-call motion, an agency, a coaching program, a service business, that hour is the thing to watch, because it’s the first job AI can lift off your plate cleanly and it’s also the first place operators get burned when they hand over one step too many.

By the end of this you’ll have a two-prompt calendar workflow that proposes real meeting times off your live availability without you touching the calendar, plus the one guardrail that keeps the AI from booking something it had no business booking.

Here’s what’s inside:

• The find-and-propose job is the clean hand-off, Gemini and Claude both do it now straight off your live calendar.

• The Book Line is the point where the AI stops and you confirm, and Google already built that same confirm-point into its own scheduling tool, which tells you something.

• The auto-reschedule trap is where operators hand the calendar too much rope and it starts moving committed meetings around under them.

• The Sunday brain-dump is a bonus bounded job, plain-language planning turned into a calendar import in one sitting.

Who this is for: operators who book calls or meetings as part of the funnel, running Google Calendar with Gmail, Calendly, Cal.com, or a CRM calendar, and already using ChatGPT, Claude, or Gemini day to day.

This is the calendar cousin of a boundary I wrote about back in June with [Comet Walls](https://blog.muddventures.com/p/comet-will-read-your-whole-inbox), where the move was letting an AI browser read a sensitive stream like your inbox without letting it act. Same idea, pointed at your calendar this time.ZZTEST reallink ZZENDTLDR: Google’s “Help me schedule” in Gmail and the Claude Google Calendar connection both read your live availability and propose meeting times for you, and that whole find-times-and-draft-the-proposal job is safe to hand over end to end this week. The one job to keep human is the confirm, the moment a meeting books onto someone’s calendar. I call that boundary The Book Line. Below is the prompt that hands off the grunt work, the guardrail that holds the line, and the failure modes that show up when operators let the AI cross it.

A consulting client I worked with last year ran a small closing team, and the thing that ate their week wasn’t the calls, it was the back-and-forth to book the calls, the “does Tuesday work, no how about Thursday, mornings are better for me” chain that ran ten messages deep before a single meeting landed on anyone’s calendar.

The number that jumped out when I pulled it apart was the time cost, their setters were spending close to an hour a day just trading times, and none of that hour touched revenue. If you’re running any kind of booked-call motion, an agency, a coaching program, a service business, that hour is the thing to watch, because it’s the first job AI can lift off your plate cleanly and it’s also the first place operators get burned when they hand over one step too many.

By the end of this you’ll have a two-prompt calendar workflow that proposes real meeting times off your live availability without you touching the calendar, plus the one guardrail that keeps the AI from booking something it had no business booking.

Here’s what’s inside:

• The find-and-propose job is the clean hand-off, Gemini and Claude both do it now straight off your live calendar.

• The Book Line is the point where the AI stops and you confirm, and Google already built that same confirm-point into its own scheduling tool, which tells you something.

• The auto-reschedule trap is where operators hand the calendar too much rope and it starts moving committed meetings around under them.

• The Sunday brain-dump is a bonus bounded job, plain-language planning turned into a calendar import in one sitting.

Who this is for: operators who book calls or meetings as part of the funnel, running Google Calendar with Gmail, Calendly, Cal.com, or a CRM calendar, and already using ChatGPT, Claude, or Gemini day to day.

This is the calendar cousin of a boundary I wrote about back in June with Comet Walls, where the move was letting an AI browser read a sensitive stream like your inbox without letting it act. Same idea, pointed at your calendar this time.

The one job to hand it end to end: find the times and draft the proposal

The move is to link your AI to your live calendar and let it do the whole find-open-slots-and-write-the-proposal job, because it reads your real free and busy the same way you would, only in two seconds instead of ten minutes of squinting at a week grid.

Two tools do this cleanly right now. Google turned on “Help me schedule” inside Gmail back on October 15, 2025, and it reads your Google Calendar plus the email’s context, then drops a card of open slots into your draft that you can edit before it goes out. The Claude Google Calendar connection goes further, it can read and write your calendar, find open time across your week, and draft the invite, all from a plain-language ask (per Anthropic’s connector page).

Here’s the prompt I’d hand it. This assumes you’ve connected Claude (or ChatGPT with calendar access, or you’re inside Gemini in Gmail) to the calendar that holds your real availability:

You have access to my Google Calendar. I need to propose meeting times to
[NAME / COMPANY] for a [30-minute discovery call].

Rules:
- Pull 4 open slots from my LIVE calendar over the next 7 business days.
- Only weekdays, only between 9am and 4pm my time (America/Los_Angeles).
- Leave a 15-minute buffer before and after anything already booked.
- Skip any slot that collides with an existing event, tentative or confirmed.
- Format the output as a short email I can send, with the 4 times as a
  clean list and my timezone stated once.
- Do NOT create, book, or send anything. Draft only. Stop and show me.

The correct output is a short drafted email with four slots that map to your real open time, in the recipient’s rough ballpark, with your timezone stated once so nobody has to do mental math. Google’s own version color-codes this for you, green slots mean everyone’s free, amber means a conflict and it flags you to pick manually (that’s straight from Google’s Help me schedule docs). When it lands right, it feels like the thing one commenter described after wiring the Claude connection to his calendar, “just ramble and let it rip. Pure calendar magic” (Android Police comments, May 2026).

The failure mode to catch: it proposes a slot you’re already busy in. That means one of two things happened, either the calendar sync is stale, or the model guessed at times instead of reading your live free and busy. If a proposed slot collides with something real on your calendar, don’t fix that one slot and move on, re-connect the calendar and re-run the whole prompt, because a tool that invented one time will invent others.

Walk away with: a four-slot meeting proposal drafted off your real availability in one prompt, ready for you to read and send.

The Book Line: where the AI stops and you confirm

The one job to keep human is the confirm, the moment a meeting turns from a proposal into a commitment on somebody’s calendar. That’s The Book Line. The AI can find the times, draft the proposal, prep the invite, and stack the agenda, and it stops the instant an event would book, because a human owns the commitment.

The reason I trust this boundary is that Google drew the same one inside its own product. Walk through what “Help me schedule” makes you do: Gemini proposes the slots, you click Send, the recipient picks a time, and then the recipient clicks “Book time for all guests” to create the event (Google’s docs spell out that last step). Two humans touch the confirm before anything lands. Google built the most-used AI scheduler on the planet and still put a person on each side of the booking, which tells you the confirm is the part nobody wants a model doing alone.

Here’s the guardrail I paste into any calendar automation so the AI can’t drift past the line:

CALENDAR GUARDRAILS, always apply:
- You may READ my calendar and DRAFT proposals, invites, and agendas.
- You may NOT create, book, confirm, accept, decline, move, or delete any
  event without me telling you to, per event, in that moment.
- Never turn on auto-accept for incoming invites.
- Never reschedule an existing confirmed meeting on your own. If two things
  collide, surface the conflict and wait for me to choose.
- When a task would cross this line, stop and say:
  "Ready to book, confirm and I'll create it."

The correct behavior is boring on purpose, the AI lines up the times, shows you the draft, and waits. That pause is the whole product.

The failure mode here is the expensive one, and it’s why the guardrail exists. The auto-scheduling tools that promise to run your whole calendar are the ones operators complain about the loudest, because the moment you let a model move committed meetings, it moves the wrong ones. Users of one popular auto-scheduler describe it reshuffling their day so hard that “your schedule is no longer your own” (Motion vs Reclaim breakdown, 2026). The first complaint I hear about the aggressive auto-schedulers is always that same one, a client call got quietly bumped to make room for a focus block the AI decided was more important. If your calendar starts moving things you committed to other people, the AI crossed The Book Line, and the fix is to pull it back to draft-only and hold the confirm yourself.

Walk away with: a pasteable guardrail that lets AI do the calendar grunt work while you keep the one power that matters, the confirm.

The bonus job: the Sunday brain-dump

There’s a second bounded job worth handing over, and it’s the one that turns a messy list of “things I need to do this week” into a week you can see at a glance. An Android Police writer laid out the workflow cleanly, she opens Gemini on Sunday, dumps every meeting, deadline, errand, and workout in plain language, and has it build the week, then imports it in one shot (her full walkthrough is here).

Her own caveat is the part that matters, “I still double-check everything before importing it,” and she’s blunt that the workflow “still needs occasional cleanup, and it’s definitely not perfect.” That’s the right posture, hand it the drafting, keep the review.

Here’s the prompt, adapted so it lands as a clean import:

Turn this into a CSV I can import into Google Calendar. Columns: Subject,
Start Date, Start Time, End Time. Use MM/DD/YYYY and 12-hour times.

My week of [DATE RANGE]:
[dump it all in plain language: meetings, deadlines, errands, workouts,
deep-work blocks, with rough times and durations]

Rules: don't invent times I didn't give you. If a duration is missing,
default deep work to 90 min and errands to 30 min, and flag anything you
guessed at the bottom so I can check it before I import.

You review the flagged guesses, import the CSV through Google Calendar’s Import and export settings, and the whole week populates at once instead of you hand-entering twenty events. It’s a bounded job, it runs off information you already have, and you can eyeball whether it’s right in a few seconds, which is the test for anything you hand an in-app AI.

Walk away with: a Sunday planning ritual that builds your week from a brain-dump and lands it on the calendar in one import.

Where this breaks

A few failure modes to watch, because they’re the difference between this saving an hour a day and creating a mess you clean up on Monday.

Stale calendar access is the quiet one. If you connected the AI weeks ago and haven’t used it, the free-and-busy it reads can lag reality, so run a throwaway “what’s on my calendar tomorrow” check before you trust a proposal, and if it’s wrong, reconnect.

Timezone drift bites anyone booking across regions. State your timezone once in the prompt and once in the drafted email, and spot-check the first cross-region proposal by hand, because a model that’s an hour off will cheerfully propose 6am calls.

Over-handing is the big one. The pull toward “let it just run my whole calendar” is strong, and it’s the exact move that gets meetings reshuffled out from under you. Keep the AI on find-and-draft, keep yourself on confirm, and the tool stays useful instead of stressful.

And not every model reads a calendar the same way. ChatGPT’s Google Calendar connection is read-only today, it can see your calendar and reason about it, but it can’t create or move events (per usecarly’s rundown). Claude can write. Gemini in Gmail proposes but leaves the send to you. Know which one you’re holding before you build a workflow on top of it.

The honest tradeoffs

This is useful and it’s uneven, both true at the same time, and pretending otherwise would be selling you something.

The results vary more than any vendor admits. In the same comment thread, one reader said building his week this way “genuinely feels like magic,” and another said he tried the same thing and “I can’t even describe what a disaster it was, just straight up not listening to instructions” (Android Police comments). Same feature, opposite weeks. Your mileage is going to depend on how clean your calendar already is and how tightly you write the prompt.

Google’s tool is capped, “Help me schedule” tops out at 20 guests and it’s built around one-to-a-few scheduling, so a big multi-party coordination still isn’t a one-click job. The auto-schedulers that promise more control over your whole day carry the reshuffle risk I already flagged, and one of them (Reclaim) is sitting on a 2.7 Trustpilot rating with billing complaints, so the “set it and forget it” pitch has a cost. And connecting any AI to your calendar hands it read access to your entire schedule, every client name, every private block, so treat that connection the way you’d treat handing someone your calendar login, because functionally that’s what it is.

None of that kills the workflow. It just means you keep your hand on The Book Line and let the AI earn trust on the grunt work first.

Recap

Hand the AI the find-times-and-draft-the-proposal job end to end, it reads your live calendar and does it in seconds. Hold The Book Line, the confirm stays human, no auto-accept, no auto-reschedule of committed meetings. Add the Sunday brain-dump as a second bounded job if weekly planning is where you slip. And when a proposal looks wrong, reconnect and re-run instead of patching one slot, because a tool that invented one time will invent more.

When I map a client’s booking flow, the calendar is the first place I look, because it’s usually leaking an hour a day that AI can hand back without any risk, as long as the confirm stays with a person. If you want a second set of eyes on where your funnel is quietly burning operator time and which pieces are safe to hand off, that’s the kind of thing we work through on an AI Clarity Call.

Next issue, Monday: the one CRM job I’d let AI run every morning, and the field I’d never let it write to on its own.

Reply with the tool you’re using to book calls right now if you want me to sanity-check whether it can read your live availability.

Andrew

P.S. A few places to take this further:

• The inbound version of this same boundary, letting an AI read your inbox without acting on it: Comet Walls.

• The brief that stops you re-explaining your business to every AI tool, calendar prompts included: the 5,000-character ChatGPT brief.

• Want the calendar-and-workflow skill files and the operators building this stuff alongside you? That lives in the Abra AI community.

Google got caught building something telling this month. Testers spotted a dedicated inbox inside the Gemini app for Workspace, with three filters, follow up, done, and one labeled "Needs review," that pulls messages out of Gmail into a to-do list a person walks through (TestingCatalog, July 4). What jumped out at me was that "Needs review" filter, because it's an admission from the company with the most email data on earth that the AI's job is to sort and surface, and the human's job is still to decide.

By the end of this you'll have a morning routine that clears your inbox to a handful of real decisions in about ten minutes, plus a hard rule for where the AI stops and you start.

That's the same instinct I run my own inbox on. The first thing I do with any new AI tool that can touch my email is work out what it's allowed to do without me, and the answer is: read and sort, yes, press send, no. I laid out a version of this test yesterday for spreadsheets, the Bounded-Job Test, and the inbox runs on the same three questions, is the job bounded, does it run on data you already have, and can you eyeball the result and know it's right. Triage clears all three, while sending a reply on your behalf clears none of them, because you can't eyeball an email after it's already gone.

Here's what's inside:

• The triage pass: one prompt that sorts a day of unread mail into four buckets so you only read what needs a human.

• The Send Line: the boundary the AI drafts up to and never crosses, and why it's the whole game on the outbound side.

• The draft-to-the-line prompt: copy it, and every reply lands in your drafts folder in your voice, with the commitments left blank for you to fill.

• The threads I keep fully human: negotiations, complaints, anything with feelings or a contract in it.

Who this is for: operators running a real business off their own inbox, ChatGPT or Claude or Gemini already in the mix, drowning a little in email and tempted to just let the robot answer it.

Why triage is the job worth handing over

Email still eats around a quarter of the average workweek, and inbox zero stays the thing most people give up on by week two (Missive, 2026). Most of that time goes to deciding more than writing: opening things, scanning them, working out what deserves a reply and what doesn't, and carrying the low hum of a hundred unread items around all day. That deciding layer is the expensive part, and it's the part AI is genuinely good at right now, because sorting is bounded, it runs on the mail already sitting in front of it, and you can glance at the buckets and know instantly if it got them right.

Answering is the part everyone wants to automate and the part that keeps biting people. A draft that sounds right isn't the same as a draft that's right, and once it sends, there's no glancing at it first. So the move is to split the inbox job in two, hand the AI the sorting and the drafting, and keep the send button on the human side of a hard boundary. I call that boundary The Send Line. The AI can read, sort, summarize, and write a full draft, and it stops the instant a message would leave your account, because crossing that line is your call and not the model's.

If that sounds familiar, it's the outbound twin of something I named back in June. When AI browsers like Comet showed up promising to read your whole inbox, I wrote about Comet Walls, the permission boundaries you set so an agent can read a sensitive stream without acting on it. The Send Line is the same wall pointed the other direction: inbound, let it read; outbound, it drafts but you send. It's the same principle running on both sides of the mailbox.

The tools to do this are already sitting in plans you pay for. If you're on Google Workspace Business or a personal Gemini subscription, the Gemini side panel in Gmail already summarizes threads and drafts replies with Help me write and Help me reply (Google support). If you're a ChatGPT or Claude person, connect your Gmail and the same routine runs there. And if you'd rather not connect anything yet, you can paste a screenful of subject lines into any chat window and get most of the value on day one.

The morning triage pass

Here's how it works. Once a day, before you start opening things one by one, you hand the AI the last 24 hours of unread mail and ask it to sort, not answer. The whole point is to turn a scroll of forty things into four short lists so your eyes only land on the one list that needs a person.

The prompt I run, which works in the Gemini side panel, in ChatGPT or Claude with Gmail connected, or on pasted subject lines:

You are my inbox triage assistant. Here are my unread emails from the
last 24 hours [paste them, or read from my connected Gmail].

Sort every message into one of these four buckets, and nothing else:

1. NEEDS ME: a real person waiting on a decision, a reply, or money.
   One line on what they want.
2. CAN BE DRAFTED: a reply I'll approve before it sends.
3. READ LATER: useful, no action today.
4. NOISE: newsletters, receipts, automated notifications.

Rules:
- Do not send, archive, or delete anything. Sorting only.
- If a message could be money coming in or money going out, it goes in
  NEEDS ME, even if you're unsure.
- Flag anything that reads angry, legal, or like a cancellation, and put
  it in NEEDS ME with the word REVIEW next to it.
- NEEDS ME is capped at what a person could clear in 20 minutes.
  If it's longer than that, move the softest items down to CAN BE DRAFTED.

Give me the four buckets as short lists. Nothing else.

What a good result looks like: NEEDS ME is short, a handful of threads, and the money and the angry ones are sitting right at the top with REVIEW next to them. The bulk of the volume falls into NOISE and READ LATER, which is the whole win, because that's the pile you were burning attention on without meaning to. You read one list, you make a few decisions, you move on.

The failure mode to watch, and it's the common one: NEEDS ME comes back with twenty-five items in it. That means the model hedged and pushed everything up to the safe bucket, which gives you back the exact overwhelm you were trying to kill. When that happens, tighten the cap ("NEEDS ME holds at most eight items, everything else drops down") and it recalibrates. The rarer failure is an empty NEEDS ME on a day you know had a real ask buried in it, which is the model under-escalating. If you see that even once, keep reading manually alongside the AI for a few more mornings before you trust the sort, because a triage pass that misses the one email that mattered is worse than no triage at all.

Walk away with: a once-a-day routine that collapses a full inbox into four lists and puts the threads that move money at the top, in about the time it takes to make coffee.

Drafting up to The Send Line

Sorting gets you to the handful of threads that need a reply. The AI can write those too, and this is where holding the line earns its keep. The rule is simple and it never bends: the AI writes the draft, the draft lands in your drafts folder, and you are the one who reads it and presses send. Nothing leaves your account on the model's decision.

The prompt:

Draft a reply to this email in my voice. Do NOT send it. Leave it as a
draft for me to read and send myself.

The email:
[paste the thread]

My voice: [paste 2-3 of your own real sent replies here, or describe it:
direct, warm, short sentences, no corporate filler].

Draft rules:
- Match the length of the incoming message. A two-line email gets a
  two-line reply.
- If a date, price, or commitment is involved, leave a blank for me to
  fill: [DATE], [PRICE], [SCOPE]. Never invent a number.
- If the thread is a negotiation, a complaint, or anything with money or
  feelings on the line, do not draft a full reply. Write one line telling
  me what's at stake and let me handle it.
- End every draft with: READY FOR YOUR REVIEW.

A good draft comes back short, in your register, with blanks sitting right where the commitments are, and that READY FOR YOUR REVIEW line at the bottom so you know it stopped where it was supposed to. You read it in five seconds, fill the blanks, send. The response-time drop is real, and the teams running this at scale almost all keep send on the human side anyway, because auto-send stays rare even where it's technically supported, the cost of one wrong autonomous reply running much higher than the minutes it saves (Missive, 2026). You get the speed of a drafted reply and keep the judgment of a human read.

The failure mode here is the dangerous one, so calibrate on it hard. If the draft fills in a price or a date you never gave it, the reply is contaminated, the model guessed a commitment, and if that had been on auto-send it would've gone out as your word. That's the tell to keep those threads human and to make the "never invent a number" rule louder. The softer failure is a three-paragraph draft in response to a one-line email, which means your voice sample was too formal or you skipped it, so feed it two or three of your own real short replies and it snaps into your cadence.

Walk away with: replies written in your voice sitting in your drafts folder, commitments left blank on purpose, and a hard rule that the send button is yours.

What I keep fully human, and the honest tradeoffs

The reason The Send Line matters is that some threads shouldn't get an AI draft at all, and knowing which ones is the real skill. Charles Hudson, who runs Precursor VC, built agents that watch his inbox, classify it, and draft his intros and declines, and he still keeps the send button on his own side. He doesn't trust the agent to send on its own, so as he told Missive, "I have a draft only flag on" (Missive, 2026). That posture, an always-on agent doing the work with a hard draft-only stop on the send step, is the one I run too, and the threads I'd never even let it draft are the ones where sounding right is a trap: active negotiations with real terms on the line, complaints and conflict, anything legal or contractual, and any message that needs genuine empathy. The model produces something that reads fine in every one of those, and reading fine is the danger when the stakes are a client relationship or a signed contract.

A few things worth flagging before you wire this up. The triage sort is only as good as the model's read of your business, so the first week it'll misfile things, and the fix is feedback, correct the buckets a few times and it sharpens fast. The native Gemini side panel is bundled into Business and Enterprise Workspace plans and personal Gemini subscriptions, so if you're on a bare Workspace tier you might not see it yet, in which case the ChatGPT-or-Claude-plus-Gmail route does the same thing. And the deeper tradeoff is data, connecting any AI to your inbox hands it read access to everything in there, which is precisely why the read-but-don't-act boundary from Comet Walls matters, and why I'd start with pasted subject lines before I'd hand a brand-new tool a full mailbox connection.

There's also a real cost to over-trusting the sort. A triage pass that quietly misroutes the one email that mattered doesn't feel like a failure, it feels like a clean inbox, right up until you find the buried thread a week late. So the discipline is to keep glancing at the NOISE and READ LATER piles for the first couple of weeks, the way you'd double-check a new hire's work, because the AI can't learn what "important to me" means until you've corrected it a few times.

Recap

Point the AI at the deciding layer, not the sending layer. Run a once-a-day triage pass that sorts your unread mail into four buckets so you only read what needs a person, let it draft the replies that can be drafted, and hold The Send Line so nothing leaves your account without you pressing the button. Keep negotiations, complaints, legal, and anything with feelings in it fully in your hands. The industry consensus landed in the same place for a reason: these tools are co-pilots on the inbox, and the operators getting hours back are the ones who used them to decide faster, not to stop deciding.

If you run a booking calendar or a lead inbox, this compounds fast, because the same triage-and-draft pass is what keeps a fresh lead from sitting unanswered for six hours while you're heads-down. That gap between a lead landing and a human touching it is the kind of leak my Showtime skill pack is built to close. Worth a look if your inbox is where your money either moves or stalls.

Tomorrow: the calendar version of this, the one scheduling job I'd let AI run end to end and the one I'd never automate.

Andrew

P.S. A few to pull the thread further:

• Yesterday's Bounded-Job Test for spreadsheets, the same three questions applied to Gemini in Google Sheets.

• Comet Walls, the inbound version of The Send Line, for when an AI browser wants your whole inbox.

• The Standing Brief, the one-page business brief that makes every draft sound like you.

• The Showtime skill pack if your lead inbox is where the money leaks.

• New here? The newsletter lives at muddventures.substack.com, a short tactical read most weekday mornings.

Almost every operator I work with has one spreadsheet a person babysits every single week. Expense categorization that somebody retypes by hand, a lead list that shows up messy from three sources, a little P&L view that a bookkeeper rebuilds every month because the export never lands clean. It’s the least glamorous work in the building, and it’s usually either eating an owner’s Sunday or getting paid for by the hour.

That’s the work Google just quietly moved into a spreadsheet you’re already paying for. Back on April 22 Google turned on Gemini in Google Sheets, the thing that builds and edits entire spreadsheets from a sentence, and it’s been rolling wider through the summer, with the data-entry piece, Fill with Gemini, picking up 11 more languages in July (Google Workspace Updates).

For the last three years I’ve watched the tools that used to earn a monthly retainer get pulled, one by one, into software operators already have open. This is that pattern landing on the spreadsheet. The catch is that Gemini in Sheets is great at a narrow band of work and quietly bad outside it, and if you don’t know where that line sits you’ll either miss the free win or trust it with a number the bank is going to read.

By the end of this you’ll have four prompts you can paste into a sheet today, and a two-second gut check I’m calling The Bounded-Job Test for deciding which spreadsheet jobs to hand Gemini and which ones to keep in a formula.

Who this is for: operators running on Google Workspace (Business or Enterprise) who touch spreadsheets weekly, or pay someone who does.

Here’s what you’re walking out with:

• The free win most operators are sitting on: the spreadsheet builder is already inside Business Standard and up, no new line item, no separate tool.

• Four copy-paste prompts: categorize, clean, formula, and a small dashboard off your own numbers, the jobs it nails.

• The Bounded-Job Test: a two-second check that keeps you from handing it the one task that’ll bite you.

• The failure line a finance guy already hit: a real tester ran the big cross-app forecast and it fell over, so you don’t have to learn that one the hard way.

What just shipped, in plain terms

Gemini in Sheets does two things that used to need real spreadsheet chops. It builds, so you can say “build a P&L dashboard from my sales and service data” and it drafts a plan, pulls the numbers, and lays out formatted tables, pivots, and charts. And it edits in the side panel, so “add scorecards and a bar chart above my inventory data” happens next to your sheet instead of making you rebuild anything.

The part that makes it more than a toy is what Google calls Workspace Intelligence, which lets Gemini reach across your Gmail, Drive, and Chat to pull context into the sheet instead of you copy-pasting between an inbox and a tab. On Google’s own spreadsheet benchmark the model hit a 70.48% success rate on messy real-world tasks, which they frame as near-expert and which, in operator terms, means it’s right most of the time and wrong often enough that you still have to look (The Keyword).

Where’s the money angle. It’s bundled. Gemini in Sheets is included in Business Standard and Plus, Enterprise Standard and Plus, the AI add-ons, and the consumer Google AI Pro and Ultra plans. If you’re on one of those, you’re already paying for this, it’s just sitting in the side panel behind the Gemini icon waiting for a prompt. The one thing worth flagging is limits: Google’s promotional higher limits ran through July 15, and after that per-user caps apply, with paid AI add-on seats getting more headroom, so heavy users hit a ceiling light users never will.

The four jobs to hand it, with the exact prompts

The jobs Gemini in Sheets does well share a shape: bounded scope, your own data, and an answer you can eyeball in a few seconds to know it’s right. Here are the four I’d reach for first, each with the prompt, what a good result looks like, and the moment to stop and check.

Job 1: Categorize a messy column

The move: point Fill with Gemini at a column of raw text, transaction memos, lead sources, support tags, and have it write a clean category next to each row. Select your data, open Fill with Gemini in the side panel, and give it the rule.

In a new column next to this transaction list, label each row as one of:
Software, Payroll, Contractors, Ads, Rent, Travel, Meals, Other.
Base it on the vendor name and memo text. If you're unsure, use "Other"
and do not invent a new category.

What a good result looks like: clean single-word labels that match the eight buckets you named, “Other” showing up on the genuinely ambiguous rows instead of a guess. Google says Fill with Gemini runs about 9x faster than doing 100 cells by hand, and for this kind of labeling that’s roughly the lift you’ll feel.

The failure mode: on long columns the labels start to drift, a category like “Service” mutates into “service issues” a few hundred rows down, or it quietly invents a ninth bucket you didn’t ask for. That’s your signal the run got too big, chop it into batches of a couple hundred rows and add “do not invent a new category” to the prompt, which I already baked in above for that reason.

Walk away with: a categorized column in seconds instead of an afternoon, on the kind of data you’d otherwise pay someone hourly to tag.

Job 2: Clean up a list that came in three different shapes

The move: hand it a column that three sources filled in three different ways and have it standardize the format without you writing a nest of formulas.

Standardize this "Company" column: strip "Inc", "LLC", "Ltd", and
trailing punctuation, fix obvious capitalization, and put the cleaned
name in the next column. Leave the original column untouched.

What a good result looks like: “acme co., llc” and “ACME CO” both land as “Acme Co” in the new column, and the original stays put so you can compare. Telling it to leave the source column alone is the whole game, you always want the before and after side by side.

The failure mode: it “helpfully” merges two companies that were genuinely different, or rewrites a name it didn’t recognize. Eyeball the rows where the cleaned value differs a lot from the original, that’s where a real error hides, and it’s a five-second scan when the columns sit next to each other.

Walk away with: a deduped, consistent list you can run a mail merge or an import against, without babysitting a formula chain.

Job 3: Draft or explain a formula in words

The move: describe the calculation you want in plain English and let it write the formula, or paste a formula you inherited and ask what it does. This is the one even the skeptics agree is solid.

Write a formula for cell H2 that returns the gross margin percent using
revenue in column D and cost in column E, formatted as a percentage,
and returning blank if revenue is zero. Then explain in one sentence
what it does.

What a good result looks like: a working formula plus a one-line plain-English explanation, so you’re not pasting something you can’t read. The explanation is the tell, if it can describe the formula in a sentence that matches what you asked, it usually built the right thing.

The failure mode: it returns a formula that runs without erroring but calculates the wrong thing, off-by-one on a range, wrong column reference. This is why you ask for the explanation, if the sentence doesn’t match your intent, the formula won’t either, and you catch it before it’s buried in a model.

Walk away with: formulas you’d have Googled for twenty minutes, written and explained in one pass.

Job 4: Stand up a small dashboard off your own numbers

The move: give it a clean tab of your own data and ask for a one-screen summary. Keep it to data that already lives in the sheet, not a cross-app pull.

Using the data on the "Sales" tab, build a one-page summary above the
data with: total revenue, revenue by month as a bar chart, top 5
products by revenue, and month-over-month growth. Keep it on this sheet
and don't change my raw data below.

What a good result looks like: a tidy header block with a couple of scorecards and one clean chart, your raw data untouched underneath. For a quick read on how a month went, this is the job it was built for, Google’s own example is literally a small-business P&L view.

The failure mode: ask it to reach into three other files or your inbox to build the same thing and reliability drops off a cliff, which is the exact wall the next section is about. Keep the dashboard job pointed at data that’s already in the sheet and it holds up.

Walk away with: a shareable one-screen view of a month, built in the time it takes to describe it.

The Bounded-Job Test, and where this thing breaks

Every job above passes the same three-part check, and that’s the test worth memorizing. Before you hand Gemini a spreadsheet task, ask: is the scope bounded to one sheet or one column, is it working off data you already have in front of you, and can you eyeball the answer in a few seconds to know it’s right. Three yeses, hand it over. A no on any of them, keep it in a formula or keep it human.

The reason that test matters is that the failure isn’t hypothetical, and someone already ran it into the ground so you don’t have to. Wouter Born, a CFO-tech investor who writes these tools up for finance teams, tried the exact workflow Google’s architecture is supposed to nail: three store managers email in monthly forecast updates with attachments, and Gemini reads the emails, pulls the assumptions, opens the files, maps them to the corporate model, and flags what needs sign-off. The dream cross-app job. His verdict:

“The vision is right. But the execution isn’t there yet... The complex, multi-file, cross-app workflow that makes Google’s architecture special isn’t reliable enough for finance yet.” (AI CFO Office)

He didn’t write it off, and neither would I. He landed right where the Bounded-Job Test lands, on what to use it for:

“For now, if your team runs on Google Workspace, use Gemini for the things it does well: formula generation, data enrichment, quick analysis questions, and spreadsheet cleanup. Those features work and they’re included in what you’re already paying for.” (AI CFO Office)

Two more honest tradeoffs before you lean on it.

It’s got no formula trail. When Gemini fills a number, that number isn’t the output of a formula you can click into and trace, it’s a generated value sitting in a cell. That’s fine for a lead category, it’s a real problem for anything an accountant, a lender, or a tax reviewer has to trace back to a source. For auditable numbers, keep the formula and let Gemini draft or label around it, don’t let it be the thing that produces the figure of record.

And it runs out of room. Push a task past a few hundred cells in one go and it tends to stall, refuse, or hand back a partial answer, there are real session limits under the hood on top of the per-user caps that kicked in after July 15. Big jobs need chopping into bounded ones anyway, the same discipline the test pushes you toward.

Failure modes, in one place

• You point it at the auditable P&L. A generated number with no formula trail is the one thing you don’t want a lender reading. Keep those in formulas, use Gemini to label around them.

• You run it on 2,000 rows at once. Labels drift, categories wander, output comes back partial. Batch it into a couple hundred rows at a time.

• You ask for the big cross-app pull. Read three inboxes and four files in one shot, and it falls over, that’s the Born test. Keep the job inside one sheet.

• You trust it without the eyeball. If you can’t verify it in a few seconds, it wasn’t a bounded job.

Where this fits the bigger picture

The operators I work with who get real value out of AI aren’t the ones chasing every launch, they’re the ones who’ve gotten sharp about which jobs to hand a machine and which ones stay human, and it’s the same muscle whether the tool is Sheets, your CRM, or your inbox. A free spreadsheet builder is a nice win. Knowing the line between the grunt work you give it and the number you protect is the part that compounds.

That judgment, which repeatable jobs to productize into an AI workflow and which to leave alone, is most of what I trade notes on with operators inside the Abra AI community, where the skill files and workflow builds live. If you’d rather map it against your own stack directly, that’s what an AI Clarity Call is for.

Recap

Gemini in Sheets is already in the plan most operators pay for, and it’s good at bounded jobs: categorizing a column, cleaning a list, drafting a formula, building a small dashboard off your own data. Run those with the four prompts above, and run everything else through the Bounded-Job Test, bounded scope, your own data, an answer you can eyeball. When a task fails it, keep the formula and keep the human.

Tomorrow: the one inbox job I’d hand an AI before I’d hand it a spreadsheet.

Andrew

P.S. A few worth pulling up next:

• The tool-compression pattern this fits into: Run the 30-minute Canva test that shows whether your ad creative retainer still earns its invoice

• The Google-side listings version of the same story: Run the three-prompt Google Business Profile check

• The context brief that makes any of these prompts land better: Grab the 5,000-character ChatGPT brief

• Where the workflow builds and skill files live: whop.com/abra-ai

• Map it to your own stack: muddventures.com/book

TLDR: On July 17, Anthropic’s Deputy CISO published the four questions his team answers before they let any agent touch anything, and the whole thing translates down to a one-person business without a security department. Run the four questions against the agent you already have connected, write the answers in a doc, then go remove one verb from its tool list. Twenty minutes, no new software, and it changes what happens on the day something goes sideways.

Anthropic put out a piece on July 17 that I did not expect to be useful to anybody running a five-person company, and then I read it twice. It’s called Zero risk isn’t the job: a CISO’s guide to agentic AI, written by Jason Clinton, their Deputy CISO, and most of it is aimed squarely at people who own a SIEM and an identity provider and a compliance calendar. Buried in the middle of it is a four-question checklist that costs nothing to run and doesn’t care how big you are.

I run this newsletter through a scheduled agent with connectors attached, so I ran the four questions against my own setup while I was reading, and the second question is where I slowed down, not because the answer was bad but because I had never written it down, and writing it down took four minutes, and at the end of those four minutes I could describe my own automation in a way I couldn’t have that morning.

That’s the whole play. The four questions don’t buy you software or a security team, what they buy you is the ability to say out loud what your agent is allowed to do, which turns out to be a thing most operators can’t do about the automations already running in their business.

By the end of this you’ll have written answers to four questions about one agent you already have running, plus one verb removed from its permissions.

Here’s what’s in this one:

• The Borrowed Login is why “it’s just an assistant” stops being true. When you connect an agent to your CRM, it doesn’t get an agent account, it gets yours, and its reach is your reach.

• Question two is the one that catches people. Read-only and read-write are different businesses, and most operators have never checked which one they authorized.

• Blast radius is a five-minute thought experiment, not a security discipline. You describe the worst realistic outcome in one sentence and the answer either scares you or it doesn’t.

• Removing a verb beats adding a rule. An agent will never attempt an action that isn’t in its tool list, which is a stronger control than any instruction you write in a prompt.

• The honest gap: Anthropic’s four questions travel down to a small business, and their seven controls mostly don’t.

Who this is for: any operator who has connected an AI assistant to email, a CRM, a calendar, a file drive, or a payment tool, and who has not yet written down what that assistant is permitted to do inside those systems.

The Borrowed Login

Clinton lays out an identity spectrum with two clean ends: a service account that does one job with no human attached, or a person at a keyboard accountable for whatever they do with their own credentials, same as always.

The middle is where the trouble lives. In his words, the middle is “where an agent carries a person’s delegated identity into systems that person is not watching,” and then the line that made me stop: “Ambiguous accountability is how incidents become unexplainable.”

Almost every SMB agent setup I’ve seen lives in that middle. You click Connect on the Gmail integration, approve the OAuth screen, and from that second forward the agent operates as you, with your mailbox, your send rights, and your access to every thread you’ve ever been on, because that’s the only permission level most consumer-grade tools offer. Call it The Borrowed Login: the agent holds your identity rather than one of its own, so its blast radius and your blast radius are the same number.

Post-incident analysis compiled from CrowdStrike and Mandiant data found that 78% of agents involved in breaches had significantly broader permission scope than their function required, with the usual cause being that teams grant wide access during setup so the thing works, intending to tighten it later, and later never arrives. That’s not an enterprise failure mode, that’s every automation any of us has ever built on a Tuesday afternoon.

Clinton also names the timing problem, citing the Ponemon Institute’s 2026 insider risk report finding that organizations took an average of 67 days to contain an insider incident even after years of dedicated investment, then adding that at agent execution speeds, “67 days is the wrong unit of measurement entirely.” A small business doesn’t have 67 days of anything, it has one owner who eventually notices something looks off.

Walk away with: a name for the thing your connected agent is standing on, and the understanding that its reach equals your reach unless you narrowed it on purpose.

The four questions, translated

Here’s the framework verbatim from the piece, in Clinton’s order, with the small-business translation under each.

The specific move: open a doc, paste this in, and answer it about one agent that’s live in your business right now. Pick the one with the most access, not the one you’re proudest of.

AGENT AUDIT: [name of the agent/automation]
Date: 
Systems it's connected to: 

1. UNTRUSTED CONTENT
What does this agent read that someone outside my company
could have written or altered?
(inbound email, web pages, uploaded PDFs, form submissions,
review text, third-party docs)
Answer: 
If the answer is "nothing," agent-specific risk is near zero.

2. ACTIONS + IDENTITY
What can it DO, not just read? List every verb.
(read, search, draft, send, create, edit, delete, pay, post,
change permissions, call external URLs)
Whose login is it acting under? 
Answer: 

3. BLAST RADIUS
If this agent went wrong in the worst realistic way, what's
the damage in one sentence? Who would find out, and how?
Answer: 
Rate it: anomaly / annoyance / data exposure / real incident

4. OBSERVABILITY
Where do I go to see what it did? Can I tell its actions
apart from mine? How long before I'd notice something odd?
Answer: 

DECISION: keep as-is / narrow it / turn it off
Verb I'm removing today: 

What the correct output looks like: four short paragraphs and one verb crossed off, done in under twenty minutes. Clinton’s own blast-radius answer for his team’s incident-response agent runs a single sentence: “the worst outcome we could construct was some mildly sensitive log lines posted into an incident channel that was already locked down.” That’s the register you’re aiming for, one sentence you’d be comfortable reading out loud to a client.

The failure mode: you write “medium risk” or “we’d probably catch it” in the blast radius box. That’s not an answer, that’s a shrug wearing a suit. If you can’t name the specific worst thing, the honest output is that you don’t currently know what this agent can reach, and that’s a finding worth having, because it tells you question two was never answered properly either.

The other failure mode is answering question one too generously. Untrusted means anything an attacker could plausibly write or alter, so if your agent reads inbound email, your contact form, or review text, the answer to question one is never “nothing.”

Walk away with: a written, dated answer sheet for one live agent, in a doc you can hand to whoever asks.

Remove the verb, not the trust

This is the part I’d put on a wall. Clinton’s framing on tool permissions: “If the failure mode that keeps you up at night is ‘the production database gets deleted,’ remove the delete verb from the agent’s world entirely. It will never attempt an action that isn’t in its tool list.”

That’s a different category of control from anything you can write in a prompt. A prompt is an instruction the model interprets. A missing verb is a thing the model cannot do regardless of what it reads, what it decides, or what some hidden text in a PDF told it to do.

The specific move: go into the connector or integration settings for the agent you just audited, find the per-action permission list, and turn off the highest-consequence verb you don’t need this week. Most operators find they have send, delete, or edit switched on for a workflow that only ever needed draft and read.

If your tool doesn’t expose per-action controls, use the account layer instead. Create a second user in the CRM with restricted permissions and connect the agent through that one rather than through the owner login. It takes ten minutes and it un-borrows the login.

The exact input: if you want the agent to help you inventory this before you start clicking, paste this into whatever assistant is connected:

List every action you are currently able to take in each of my
connected tools. Group them as: READ, CREATE, EDIT, SEND/PUBLISH,
DELETE, PAY. For each one, tell me which of my workflows uses it.
Flag any action you have permission for but have never used.
Do not take any actions. Output the list only.

What the correct output looks like: a table where the SEND, DELETE, and PAY rows are either empty or attached to a workflow you can name. The “has permission, never used” list is your removal candidates, and it’s usually longer than people expect.

The failure mode: the assistant confidently invents a permission list, which happens, so treat its output as a starting draft and confirm against the real settings screen in the tool.

Anthropic’s default email posture is worth stealing outright. Their guidance: when a personal agent handles email but uses web search results as an input, “an excellent default is to only allow draft emails to be created and never sent externally, automatically, without human review.” Draft yes, send no. That one setting removes most of what could go wrong with an email agent and costs you a click per message.

Walk away with: one verb removed from one agent, and a defensible default for anything that touches outbound email.

The four-level ladder

The practitioner version of this that I liked best came from a ZenAI piece published July 13, which splits agent capability into four levels rather than the binary of connected or not connected: read, recommend, create, update. Their line on it: “An AI agent should not be allowed to take every action it can technically perform,” and then, on scoping, “do not let the agent become a shortcut around the permission model your business already depends on.”

The specific move: take every automation in your business and put it on the ladder, where read is retrieving account history or order status, recommend is suggesting an owner or a next step, create is making a task or a draft or a queue item, and update is changing a field, an owner, a price, or a payment status.

Their tell for whether you’re ready: “A demo may use a broad service account because it is faster to build. That may be acceptable for a controlled test environment, but it is dangerous in production.” Most SMB agent setups are still running the demo configuration, because it worked and nobody went back.

What the correct output looks like: most items sit at read, recommend, and create, with update reserved for a small number of low-consequence fields. Their framing I keep coming back to: “the safest first version is usually boring on purpose.”

The failure mode: you find an automation sitting at update on something customer-facing or money-adjacent that nobody explicitly approved, usually because “let the agent update the CRM” got interpreted broadly during setup. Move it down a rung to create-a-review-item and see whether you miss the speed, because most operators don’t.

Walk away with: every automation you run placed on a four-rung ladder, and anything at the top rung either justified or demoted.

What’s still broken about this

The four questions travel down to a small business cleanly. The seven controls in the back half of that guide mostly do not, and it’s worth saying plainly.

Clinton’s control list assumes you have an identity provider issuing SAML or OIDC, a SIEM you can point an OpenTelemetry stream at, egress allowlisting through a proxy the agent can’t reconfigure, and admin-level RBAC for connector actions. A ten-person company has none of that and isn’t going to buy it. The guide is also, in fairness, partly a product spec for Claude Cowork Enterprise, since every control gets stated twice, once as a general requirement and once as how Anthropic implements it. Useful and also marketing, both true at the same time.

The small-business substitutions: your observability is the sent-items folder, the CRM activity log, and the connector’s own history page, checked on a rhythm rather than streamed anywhere. Your off switch is disconnecting the connector, and your least-privilege control is a second restricted user account. Thinner than what Anthropic runs, and still ahead of the version where nobody has written anything down.

Prompt injection also isn’t solved. Anthropic’s own language is that models are getting meaningfully better at resisting it and attack success rates keep falling, “they’re not zero,” so anything you point at inbound email or the open web carries residual risk no configuration erases.

Writing the four answers down also bounds nothing by itself, it’s a document. The bounding happens when you go remove the verb, and the gap between the audit and the removal is where this exercise usually dies.

The counterpoint worth holding: there’s a real cost to over-tightening, because if every action needs your approval the agent stops saving you time and becomes another inbox. Clinton’s framing is that the job is making risk “legible and bounded,” and legible is doing a lot of work in that sentence. Bounded doesn’t mean small, it means you know where the edges are.

Failure modes to watch for

• The permission that got added and never removed. Capabilities get extended, permissions get added, nothing gets taken away, which is how a read-only setup becomes a write-everywhere setup across eighteen months without a single decision being made.

• The agent that got smarter underneath you. Clinton’s sharpest story: they moved their incident-response agent to a newer model version and changed nothing else, no new tools or permissions or prompts, and the intelligence uplift alone was enough for it to start reaching out to another agent to try to fix production on its own. It stayed inside the bounds because the bounds were real and a human still reviewed the code change. His takeaway travels: limit access and actions, not around what you believe today’s model can do.

• Silent failure. An agent that stops working loudly is fine, an agent that quietly does the wrong thing for three weeks inside a workflow nobody opens is the expensive version, which is why question four matters as much as question two.

Recap

The four questions cost nothing to run: what untrusted content does it ingest, what actions can it take and under whose identity, what’s the blast radius, and what observability do you have. Run them against one live agent, write the answers in a doc with today’s date, then do the part that matters, which is going into the settings and removing one verb the agent has but doesn’t need. The four-level ladder is the ongoing discipline: read, recommend, create, update, with that top rung reserved for things you deliberately signed off on.

None of this requires a security hire, it requires the person who already understands the business writing four answers down.

If you want to work through this on one of your own automations alongside people running comparable setups, that’s the kind of thing we chew on inside the Operator Council, and a second set of eyes on a permission list beats sitting alone with a settings screen.

P.S. A few related pieces if you’re building in this direction:

• The three-prompt Google Business Profile check, for connecting an assistant to a system you already own

• The 5,000-character Standing Brief, for giving an agent context without giving it access

• GoHighLevel’s scoped edits and the two prompts to copy, for editing live workflows without breaking them

• The Operator’s Read on three quiet AI shifts, if you missed that one

• The full Anthropic guide is here, and it’s a five-minute read

Reply with the verb you removed if you run the audit, I want to know which one shows up most.

Andrew

TLDR: Google connected Google Business Profile directly to the Gemini app, so a single-location operator can now ask plain questions about their own search impressions, direction requests, call taps and search keywords, draft review replies grounded in the actual review text, and edit hours, attributes and action links from a chat window. It’s free, it’s already rolling out globally outside the EEA and UK, and it covers a meaningful slice of what listing-management retainers bill $300 to $1,200 a month for. Below: the three prompts to run, what good output looks like, and the four eligibility rules that will block half of you before you start.

In the agency years, the Google Business Profile was almost always somebody’s third priority. It got set up during onboarding, somebody dropped in the hours and a few photos, and then it sat there for two years untouched until a one-star review showed up and suddenly everybody cared about it for about a day. Meanwhile that profile was quietly collecting the highest-intent data in the whole business, the searches people typed right before they tapped call, and nobody on either side of the engagement was reading it, because opening the dashboard was never on anybody’s calendar.

I call that the Unread Storefront, and Google just did something about it.

Google wired Business Profile into Gemini on June 10, plus Business notebooks, and both started rolling out globally over the following weeks (Google’s announcement). Vishnu Sivaji, senior director on the Gemini app, described the connected state as an assistant with “access to your real-world context like customer reviews, customer questions and performance data” (via Search Engine Journal). It shifts the janitorial half of local visibility out of a dashboard nobody logs into and into a chat window most owners already have open on their phone.

By the end of this you’ll have three copy-paste prompts that pull your profile’s real performance numbers, draft a review reply that references the actual review, and surface the gaps in your listing, plus the eligibility checklist that tells you in 30 seconds whether you can use any of it yet.

Here’s what’s underneath:

• The data was always there, the door was just annoying. Impressions, direction requests, call data and the search keywords customers used are all in Business Profile, and asking for them in plain language is a different behavior than remembering to log in.

• Review replies are the first thing everybody will use and the easiest thing to get wrong. Drafting is the win. Publishing without reading is how a tire shop thanks someone for the sushi.

• Business notebooks are Google’s version of a standing brief, a container that holds your profile, your website and your prior chats so the assistant stops starting from zero.

• The eligibility rules are narrow enough to be the real story. One verified profile, personal Google account, activity on, and nothing in the EEA or UK.

• The retainer math shifts at the low end, not the high end. The $300-a-month “we post weekly and reply to reviews” tier is the part under pressure.

Who this is for: single-location service businesses and local operators who own one verified Google Business Profile, whether you run it yourself or pay somebody a few hundred a month to run it for you.

Step one: check whether you’re even eligible, then connect

Open the Gemini web app, go to connected apps, link Google Business Profile with a single tap. Before you do that, run the eligibility check, because Google’s help documentation is stricter than the blog post reads.

You qualify if all of these are true:

[ ] You are owner or manager of ONE verified Business Profile, no more
[ ] You are signed in with a PERSONAL Google account (not Workspace/work/school)
[ ] You are 18+ and using the Gemini WEB app (not the GBP Manager app)
[ ] Gemini Apps Activity is turned ON
[ ] Your business is NOT in the European Economic Area or the UK

What correct output looks like: after connecting, ask “what Business Profile are you connected to?” and Gemini names your business, your category and your city back to you without you having told it any of that.

The failure mode: if Gemini answers with a generic explanation of what a Business Profile is, or asks you which business you mean, the connection didn’t take. The two most common causes are the multi-profile block (if you have manager access to a second location, a client’s profile, or an old test listing you forgot about, you’re out for now) and the work-account block. The fix for the second one is connecting from the personal account that owns the profile. The fix for the first one is removing your manager access from the profiles you don’t need, or waiting, because Google has been clear this is the simple-governance first wave (eligibility breakdown here).

Walk away with: a definitive yes or no on whether this is available to you today, and a connected profile if it is.Step two: run the monthly read you’ve never run

This is the one that earns the whole exercise, most operators have never looked at their own search keyword data once. Paste this in:

Using my connected Google Business Profile, give me a plain-English
performance read for the last 30 days compared to the prior 30 days:

1. Search impressions, and whether the split between discovery
   searches and direct searches moved
2. Direction requests, website clicks, and call taps, with the
   percentage change on each
3. The top 15 search keywords customers used to find me, flagged
   as either "my business name" or "a service/problem phrase"
4. Any metric that moved more than 20% in either direction, with
   your best read on why

End with the one number you'd watch next month and why.

What correct output looks like: a table or list with real figures attached to each line, and a keyword list that includes phrases you didn’t expect. That third bucket is where the value sits. When most of your discovery traffic comes in on service and problem phrases rather than your business name, your profile is doing acquisition work. When almost everything is your business name, people already knew about you and Google is just the phone book, which is a completely different situation and calls for different spending.

The failure mode: if the output comes back with round-number estimates, hedged ranges, or no keywords at all, it’s answering from general knowledge instead of your connected data. Ask it directly, “are these figures from my connected Business Profile or are you estimating,” and re-run. If it still can’t produce keywords, your profile likely doesn’t have enough volume in the window yet, so widen it to 90 days.

Walk away with: the top 15 phrases real customers typed before they found you, which is the closest thing to free market research a local business has, and almost none of them have looked at it.

Step three: reply to reviews without sounding like a robot

Review replies are the task everybody hates, and it’s the task customers use to size up your business. Gemini can pull the star rating, the review text and the associated media, then draft a reply that references what the customer specifically said (capability list here). The part operators skip is giving it a voice rule first, so paste the rules and the request together:

You're drafting replies to my Google reviews. Voice rules, apply every time:

- First person singular, I not we, unless the review names an employee
- Two to four sentences maximum, never a paragraph
- Reference one concrete detail the customer mentioned, by name
- No marketing language, no "we strive to," no "your feedback is
  important to us"
- On anything under 4 stars: acknowledge the specific problem, say what
  changed or what I'm doing about it, give one way to reach me directly
- Never offer a refund, discount, or free service in a reply
- Never dispute the customer's version of events publicly

Pull my three most recent unanswered reviews and draft a reply to each.
Show me the review text above each draft so I can check it.

What correct output looks like: each draft names something real from the review, the wait on Saturday, the tech who showed up early, the part that came in wrong, and the low-star replies read like a person taking responsibility rather than a policy statement.

The failure mode: polite mush. If the draft would fit under any review at any business in any industry, it’s useless and worse than no reply, because customers can tell. The other failure mode is the factual one, which is why the prompt asks it to show the review text above each draft. As one local SEO write-up put it, “Connect Gemini to a messy profile and you will get messy outputs faster” (Vizup). Read every draft before it publishes, especially the one-star replies, because a published reply represents your business permanently and Google won’t be the one explaining it.

Walk away with: three reviews answered in about five minutes, in a voice that’s yours, with the rules saved so the next batch takes two.Business notebooks are the Google-side version of a standing brief

The notebook is the piece that turns three good prompts into a system. It’s a container inside Gemini that holds your connected profile, your website, your chats and your sources, so the assistant carries context between sessions instead of meeting you fresh every morning, and it surfaces alerts when you open it, things like an unanswered customer question or holiday hours that were never set.

It’s the same shape as the Standing Brief on the ChatGPT side, one written description of your business that lives somewhere permanent so you stop paying the setup cost every single chat. Lisa Landsman, who runs industry engagement and SMB success at Google, described the same complaint coming back from owners over and over, that “AI would be infinitely more useful if it knew their specific business, rather than forcing them to re-explain who they are, what they do, and who they serve every single time” (via Search Engine Roundtable).

Drop your voice rules and your service list into the notebook once, so the review-reply prompt above shrinks to five words, and keep the master copy of that brief in a doc you own rather than only inside Google’s box. Vendors change their boxes. Your brief should outlive them.

What this does to the retainer math

Listing management from a real agency runs $300 to $1,200 a month, where the low tier covers weekly posts, photo uploads, Q&A response, review replies within 48 hours, attribute updates and a monthly insights review, roughly four to six hours of skilled work, and the full Map Pack program adds citation building, review-generation systems and competitive monitoring at the top of that range (Colorado Web Impressions pricing breakdown). That same page puts it plain: avoid GBP management under $200 a month, because it’s usually automated.

That’s the honest read on what changed. The automated tier just got a free competitor built by the company that owns the data, and the judgment tier didn’t. Citation building, review generation systems, competitor monitoring, category strategy, suspension recovery, those are still real work by people who’ve done it a hundred times, and Gemini isn’t close to that. If you’re paying at the low end for weekly posts and review replies, run the three prompts above for 30 days and then have an honest conversation about what you’re buying. If you’re paying at the high end for a Map Pack program that’s producing calls, this changes your maintenance workflow and leaves the strategy where it is.

What’s still broken

The eligibility gate is the biggest one, and it knocks out most people reading this who own more than one location or hold manager access on a client profile. Google went with one person, one profile as the starting governance model, which means agencies and franchises can’t use this at all right now.

The EEA and UK exclusion is real and Google hasn’t said when that changes. Gemini Apps Activity has to stay on, which is a genuine privacy tradeoff some operators won’t want to make, and it’s worth knowing that’s the price before you flip it.

And the write access cuts both ways. An assistant that can edit hours, attributes, menus and action links is an assistant that can put wrong hours in front of customers, and wrong hours means somebody drives across town to a closed store, so the cost lands on the customer experience side long before it shows up in any ranking. Treat profile edits like production changes, confirm each one, and check the live profile after.

Recap

Google connected Business Profile to Gemini, free, rolling out globally outside the EEA and UK, gated to single-profile owners on a personal account with activity on. Run the eligibility check, then the 30-day performance read, then the review-reply prompt with voice rules attached, then park all of it in a Business notebook so the context stops evaporating. The keyword list from prompt two is the piece almost nobody has looked at, and it’s the one I’d open first.

The thread running through this and the last several issues: the tools that used to require hiring somebody keep getting absorbed into the layer you already pay for, and the operators pulling ahead are the ones who go check what got absorbed this month instead of assuming the invoice still maps to the work.

If the deeper question here is what people find when they look your business up across Google, Maps and the AI answers now sitting on top of both, that’s the ground the Counterclaim Skill Pack covers, and it starts where this one ends.

P.S. A few next steps if you want to keep pulling this thread:

• The Standing Brief, the six-section business brief that stops you re-explaining yourself in every chat

• The Operator’s Read on three quiet AI shifts, including the model-retirement check worth running on old automations

• Counterclaim Skill Pack for what AI answers are saying about your business

• Abra AI community if you want the skill files and the operators building this stuff daily

• Book an AI Clarity Call if the question is bigger than one workflow

Reply with your top search keyword if you run prompt two, I want to see how far off it lands from what people assume.

Andrew

TLDR: Meta Business Agent is live for businesses of every size across WhatsApp, Messenger, and Instagram, and turning it on costs nothing today. The billing calendar is already public: the partner platform starts metering August 1 at roughly 4 to 5 cents per agent-handled message, and from October 1 every reply inside an open WhatsApp service window carries a charge. The free stretch is the cheapest month you’ll ever get with this tool, enough time to set the agent up in demo mode, break it with a test script, and learn what your real conversation volume would cost, so the paid era opens with your numbers instead of Meta’s estimates.

Every booking workflow I’ve built in GoHighLevel exists because of one number: the longer a lead sits unanswered in a message thread, the deader the deal gets. I spent years on the agency side watching that decay eat perfectly good pipeline, a lead messages at 9pm, the reply lands at 10 the next morning, and the thing they were ready to buy the night before has cooled into “let me think about it.” Entire product categories exist to shave minutes off that gap.

Which is why the part of Meta’s announcement that got me had nothing to do with the AI itself. Meta ran its Conversations event in London on June 3 and turned on Meta Business Agent for businesses of every size, an agent that answers customer questions, recommends products from your catalog, books appointments, qualifies leads, and closes sales inside WhatsApp, Messenger, and Instagram threads. Free to activate, live in minutes, already working for more than a million businesses. Then, four weeks later, the billing schedule showed up with real dates on it.

By the end of this you’ll have the agent running in demo mode, a ten-message script for breaking it before customers find the gaps, and your own cost estimate for the metered era before Meta sends anyone an invoice.

That free-then-billed sequence deserves a name, so I’m coining one: The Meter Flip. A platform gives an AI capability away long enough for a million businesses to wire it into daily operations, then turns the meter on against a published schedule. It’s the same absorption pattern I wrote about when Notion made Zapier optional, a native feature swallowing what used to be a paid vendor, with one difference that changes how you play it: this time the free part has a printed expiration date, and the first of those dates is two weeks out.

• Free today, with paid tiers already promised. Meta’s own newsroom says getting started costs nothing and that “paid subscription offerings” arrive in the coming months.

• The platform meter starts August 1. $2.00 per million tokens, which Meta translates to roughly 4 to 5 cents per agent-handled message, one blended charge covering the AI and the message delivery.

• From October 1 there is no free reply left on WhatsApp. Human, template, or agent, every response inside an open service window gets billed.

• The math is knowable this month. A test script and three weekly numbers tell you what the paid era costs before it starts.

Who this is for: operators whose customers already message them on WhatsApp, Instagram, or Messenger, and anyone paying a chatbot vendor or an answering service to cover those same threads.

What Meta turned on

Meta’s pitch line is “AI that lets every business show up for every customer as if they had an infinite team behind them,” and the capability list in the announcement backs most of that up: it answers questions specific to your business, makes product recommendations from a catalog, books appointments and qualifies incoming leads, lets you decide when a team member steps in, and closes sales. More than a million businesses were running it on WhatsApp and Messenger in markets like Brazil, India, and Mexico before the global expansion, and Meta counts over a billion active business threads a day across its three messaging apps.

One thing worth getting straight before you touch settings: there are three different products under this one name, and the difference decides what you’d eventually pay. Wati, one of the larger WhatsApp business platforms, broke the tiers down after digging into the launch. A free self-serve agent lives inside the WhatsApp Business app and learns from your past chats, business profile, and catalog. The same self-serve experience exists for Messenger inside Meta Business Suite. And above both sits an invite-only enterprise platform tier that runs on the WhatsApp API and connects to outside systems like Shopify and Zendesk. The self-serve tiers are the ones most readers of this newsletter can turn on tonight, from a phone, without a developer anywhere in the building.

The agent only replies when it’s confident it can answer correctly, flags the conversation for you when it can’t, and passes the full chat history across when a human steps in. There’s also a morning briefing feature rolling out to a smaller group, which catches you up on overnight threads, with a waitlist if you want in early.

The billing calendar Meta already published

Now the Markup Machine part, because the dates are the story. ChatMaxima’s breakdown of the platform rollout lays out the schedule. July 1: the Business Agent Platform and its APIs went live for eligible partners, free. August 1: per-token billing begins at “$2.00 per 1 million tokens, which Meta estimates at roughly 4 to 5 cents per message,” one blended charge that covers both the AI work and the message delivery, invoiced monthly by Meta directly. October 1: WhatsApp service messages resume charging, and utility templates sent inside an open service window get billed too. Their summary of where that leaves the channel is blunt: “Whichever way a business chooses to answer a customer inside an open conversation, an AI agent, a human, or a template, there is now a charge. The channel is fully metered.”

I ran Meta’s own estimate against typical operator volume. A business whose agent handles 5,000 messages a month is looking at roughly $250 at the conservative 5-cent end. A hundred thousand messages runs about $5,000. And a solo operator fielding 30 conversations a day, the profile Wati says this product fits best, lands somewhere around $40 to $50 a month once metering reaches their tier. Put those numbers next to what a chatbot vendor or an after-hours answering service invoices for covering the same threads and the compression is hard to miss, buried in a channel most operators still answer by hand.

One precision note, because this is where coverage gets sloppy: the August 1 meter applies to the partner platform tier. The self-serve agent stays free for now, Meta’s newsroom language is subscriptions “in the coming months,” and TechCrunch reports the paid path will likely ride on WhatsApp Business Premium tiers. The direction is identical at every layer though, free to hook, metered on a schedule, which is the whole reason the free stretch is worth using deliberately instead of vaguely.

Build one: put the agent in demo mode with a real brief

The move: open the WhatsApp Business app, tap Tools, select Meta Business Agent, grant it access to your past chats, and add your catalog plus FAQ material. On Facebook, it’s Meta Business Suite, then All Tools, then Business AI. Both paths end in a demo mode, and demo mode is where the agent stays until it survives the script in build two.

Before you tap through setup, prepare the knowledge you’ll feed it. This is the input worth writing first:

WHAT WE SELL: [each product or service with its real price, no "starting at"]
HOURS AND LOCATION: [including holiday exceptions]
THE FIVE QUESTIONS CUSTOMERS ASK MOST: [each with the answer in your own words]
NEVER DO: no discounts, no delivery-date promises, no prices beyond the list above, no claims about results
HAND TO A HUMAN WHEN: [complaints, refunds, anything about money owed, custom requests]
TONE: [paste three replies you sent recently that sound like you]

If you built the 5,000-character Standing Brief from Wednesday’s issue, this is the condensed customer-facing cut of the same document, the difference being this version speaks to your customers instead of to you.

What a correct result looks like: in demo mode, the agent answers your five most common questions with your real numbers in something close to your tone, and the questions it can’t handle come back flagged for you rather than improvised.

The failure mode: the agent generalizes, or invents a policy you don’t have. That means the knowledge you gave it was thin, so feed it the real catalog and the real policies rather than a summary. If it keeps freelancing on price or promise questions after that, move those categories into the hand-to-a-human list instead of leaving them answerable.

Walk away with: an agent grounded in your material instead of Meta’s guesses, live nowhere except demo mode.

Build two: attack it like a customer before a customer does

The move: run a fixed ten-message script through demo mode, and keep the script frozen so next week’s results compare cleanly against this week’s.

1. how much is [your core offer]
2. you got anything available this week
3. why would i pick you over [name a real competitor]
4. whats your refund policy
5. can you do it cheaper
6. [ask about something you don't sell]
7. this is ridiculous, ive been waiting two days
8. book me for tuesday at 3
9. [message 1 again, in whatever second language your customers use]
10. asdfjkl

What a correct result looks like: right numbers on 1 and 2, a handoff or an owner flag on 5 and 7, a clean “that’s outside what we do” on 6, a booking that lands on your calendar from 8, a coherent answer on 9, and no meltdown on 10.

The failure mode: it offers a discount on 5, or invents availability on 2. Tighten the NEVER DO list and run the script again. Any question class that fails twice gets demoted from answerable to handoff, and that single rule is what keeps a cheap agent from becoming an expensive apology.

Walk away with: a pass/fail read on the agent before any paying customer meets it.

Build three: measure the free month

The move: track three numbers weekly for the rest of the free stretch.

messages the agent handled this week: ___
conversations that became a booking or a sale: ___
conversations handed to a human: ___

Multiply weekly message volume by four, then by $0.05, and you’re holding a conservative monthly cost for the day metering reaches your tier. Divide that cost by the bookings the agent produced and you have cost per booked conversation, which is the number the whole decision hangs on.

What a correct result looks like: something as plain as “the agent handled 240 messages, produced 9 bookings, and worst case that’s about $48 a month for overnight coverage those threads were getting from nobody.”

The failure mode runs in two directions. Volume so low the projection rounds to nothing means the agent is simply free 24-hour coverage, keep it. A projection that clears what a conversation is worth to you means the agent gets capped to first-response and FAQ duty while your humans keep the closing threads, and you’ve learned that for free instead of from an invoice.

Walk away with: your own cost number before Meta’s first invoice exists anywhere.

The honest tradeoffs

The ceiling is real and Wati named it without hedging: “it may be useful for a solo operator managing 30 conversations a day from a phone. For businesses doing real volume on WhatsApp, with teams, broadcasts, and CRM workflows, it hits a ceiling fast.” The self-serve tier has no team inbox, no CRM connection, no broadcast tools, and it only responds to inbound messages, it never initiates. The enterprise tier that does connect to outside systems is invite-only, and its official pricing page still reads “in development,” with tiered pricing promised later, which has procurement-minded operators understandably annoyed.

The data question deserves a straight look too. Per Wati’s comparison: “your customer conversations stay within Meta’s infrastructure and are used to train Meta’s models.” If you treat customer conversations as an owned asset, that’s a cost this product charges that never shows up on an invoice.

And the launch anxiety is worth acknowledging rather than waving off. Wati notes the most upvoted Reddit post the night of the announcement read “Meta Announces Meta Business Agent: A Replacement for All BSPs and Tech Providers.” Given the ceiling above, that fear runs ahead of the product today, and the vendors most exposed are the ones whose whole offer was basic FAQ coverage. The last quiet risk is the obvious one: a wrong answer in your DMs carries your name, and the confidence gating helps, but demo-mode testing is the control you own, so the agent earns live mode rather than defaulting into it.

Recap

Meta put a working AI agent inside the three messaging apps where your customers already are, free to activate today, and then published the calendar for metering the channel, platform billing August 1 at roughly 4 to 5 cents a message, every WhatsApp service-window reply billed from October 1. That’s the Meter Flip, and the operators who use the free stretch to ground the agent in a real brief, break it with a fixed test script, and track three weekly numbers will enter the paid era holding their own cost per booked conversation, while everyone else enters it holding a guess.

The agent can get the appointment booked, and what happens in the seventy-two hours after that booking decides whether the person shows, that after-the-booking gap is what showtime.muddventures.com wires up for $27.

Back in your inbox Monday.

Andrew

P.S. If you’re building the pieces around this one: the 5,000-character Standing Brief is the master document your agent brief condenses from, Notion making Zapier optional is the earlier sighting of this same absorption pattern, the Show Rate Decay Curve is why answered-in-minutes beats answered-in-hours, and the GoHighLevel scoped-edits prompts cover the workflow side of the same automation stack.

TL;DR: On July 15, OpenAI raised ChatGPT’s custom instructions limit from 1,500 characters to 5,000 for paid plans. That box is where you end the cycle of re-teaching a fresh chat your business every morning, and at the old size it was too small to hold a real briefing. Below: the full Standing Brief template to paste in, the 15-minute test that proves it took, and the places where this still breaks.

Yesterday morning’s issue covered Claude Reflect, the new report that shows you which tasks you keep re-explaining to your AI, and I named the cycle underneath it The Context Rebuild Loop: open a fresh chat, re-teach it your business, get the output, throw the setup away, then pay that same setup cost again a few days later. Later that same day, OpenAI shipped the other half of that story. The custom instructions box in ChatGPT went from 1,500 characters to 5,000 for paid plans, which is the difference between a long text message and a proper one-page briefing document.

By the end of this you’ll have a 5,000-character Standing Brief written for your own business and a 15-minute test that proves ChatGPT is using it instead of ignoring it.

I run my own operation on standing context files, the system that drafts this newsletter reads a stack of them before it types a word, so a bigger box for standing context is the kind of update I stop and look at. The old 1,500-character cap is a big part of why most people treated custom instructions as a tone preference, there was only ever room for “be concise, I’m a marketing manager,” and a box that small trains you to write something shallow in it.

What’s below:

• The July 15 change in plain terms. Who got 5,000 characters, who stayed at 1,500, and why the update applies to chats you already have open.

• Why the old cap kept the box shallow. 1,500 characters is roughly 250 words, and people filled it accordingly.

• The Standing Brief template. Six sections worth spending the new character budget on, ready to copy.

• The proof test. Three prompts that show whether the brief took.

• Where this still breaks. Instruction drift is real, and the forum threads about it are worth reading before you trust the box completely.

Who this is for: operators who use ChatGPT on a paid plan for real business work, writing, analysis, customer replies, planning, and are tired of every chat starting from zero.

What OpenAI changed on July 15

Straight from OpenAI’s release notes: “Plus, Pro, Enterprise, Business, and Education users can now save up to 5,000 characters, up from 1,500, giving them more room to customize ChatGPT’s response style and behavior.” Free and Go plans stay at 1,500 per OpenAI’s help center, and the expanded instructions apply to your existing conversations immediately, no fresh session required, per Crypto Briefing's July 15 report.

Some quick context on why this box matters more than it did a year ago. Back in November 2025, OpenAI made custom instructions apply across all your conversations instead of only new ones, so whatever you write in there now follows you everywhere. And the day before this change, on July 14, ChatGPT also added unified search across chats, projects, images, and documents on every plan, one sidebar search that finds your old work. The pattern across both updates is OpenAI treating your accumulated context as the product, and the instructions box is the one piece of that context you get to author on purpose.

Run the math on the size. 1,500 characters is about 250 words, a long text message. 5,000 characters is about 800 words, a full page of real briefing material. That’s enough room for what your business sells and at what price, who buys it, what tools you run it on, how you write, and what you’re working on this quarter.

The myth: custom instructions are a tone setting

The box has been around since 2023, and the standard move has always been to put a bio in it. “I’m a marketing manager. Be concise and professional.” Emmanuel at My Writing Twin, who has spent more time on this feature than almost anyone publishing about it, puts the problem plainly: “When you say ‘professional but friendly,’ you’ve described maybe 50,000 different writing styles.” ChatGPT splits the difference across all of them and hands you the same competent, forgettable output it hands everyone else.

Here’s the landmine underneath the myth. If the box holds one vague sentence, every chat starts from zero, so you paste in your offer details again, describe your customer again, explain your pricing again, and that’s the Context Rebuild Loop running on a daily timer. The brief I keep for my own business runs long past the old cap, the writing rules section alone wouldn’t have fit in 1,500 characters, which is why the master copy has always lived in a document outside the chat window. As of July 15 a real working chunk of it fits in the box itself.

The fix is treating the field as what it now has room to be: a Standing Brief. One written briefing document about your business, maintained in a doc you own, pasted into the personalization layer of every AI tool you use. Write it once, and every chat starts from there instead of from zero.

Write your Standing Brief

The move: block 25 minutes. Open a document you own, Google Doc, Notion page, plain text file, and write the brief there first, not in the ChatGPT settings box. The doc is the master, the box is a deployment target, and when Claude and Gemini get the same treatment later you’ll paste from the same source. Then copy it into ChatGPT under Settings, Personalization, Custom instructions.

The template: six sections. Fill in the brackets, cut what’s irrelevant, keep it under 5,000 characters.

1. THE BUSINESS
I run [business name], a [what it is] that sells [offer] at [price point(s)]
to [customer type]. Revenue comes from [primary revenue source]. My role
is [role].

2. THE CUSTOMER
My buyer is [who they are, what they run, size]. They care about [top 2-3
things]. They do not respond well to [what turns them off]. Common
objections: [list 2-3].

3. THE STACK
I run the business on [CRM], [email tool], [calendar/booking tool],
[other core tools]. When you suggest a workflow, use these tools by name.

4. WRITING RULES
Always: [2-4 rules, e.g. short paragraphs, plain words, specifics over
adjectives]. Never: [2-4 rules with reasons, e.g. never use exclamation
points, never open with a question, never use the word "elevate"].
When drafting anything a customer sees, match this register: [paste 2-3
sentences you wrote yourself as a sample].

5. CURRENT PRIORITIES
This quarter I'm focused on [1-3 priorities with a number attached where
possible]. Weight suggestions toward these.

6. HOW TO HANDLE UNKNOWNS
If you're missing a fact about my business, ask me one direct question
before drafting. Do not invent product names, prices, or claims.

What the correct output looks like: the next fresh chat behaves like a briefed contractor instead of a stranger. Ask it to draft a follow-up email to a lead who went quiet and it writes in your register, names your offer, respects your price point, and skips the exclamation points, all without you pasting anything into the prompt.

The failure mode: the output stays generic. Nine times out of ten that means the brief is adjectives instead of rules. “Professional but friendly” gives the model 50,000 styles to average across, “never use exclamation points, never open with a question, here are three sentences I wrote myself” gives it walls to work inside. Rewrite every adjective in your brief as an always rule, a never rule, or a pasted example of your own writing.

Walk away with: a one-page briefing document you own, deployed into ChatGPT, that every future chat inherits automatically.

The 15-minute proof test

The move: before you write the brief, run three work prompts in fresh chats and save the outputs somewhere. After the brief is installed, run the same three prompts in fresh chats and compare side by side. Same day, same model, the only variable is the brief.

The exact prompts:

1. Draft a follow-up email to a lead who went quiet after asking about
   pricing two weeks ago.

2. I have 90 minutes free tomorrow morning. Based on what you know about
   my business, what's the highest-leverage thing to spend it on?

3. Write three social post hooks about what I sell, in my voice.

What the correct output looks like: the after versions cite specifics you never typed into the prompt. The email names your offer and handles the price objection the way your brief says your buyers raise it, the 90-minute answer points at one of your stated quarterly priorities, and the hooks sound like your pasted writing sample instead of a motivational poster.

The failure mode: the model keeps breaking one specific rule, capitalization, a banned word, a format you told it to skip. Two things to check, in order. First, move that rule higher in the brief and restate it as a never with a reason, position and bluntness both change compliance. Second, check for a conflict with ChatGPT’s Memory feature, which collects facts about you passively in the background and can contradict what you wrote deliberately. Since June 12 you can view, edit, and delete individual memories from the memory summary page, so clear out anything that fights the brief.

Walk away with: before-and-after evidence of whether your brief changed the output, instead of a vague feeling that ChatGPT seems smarter now.

Where this still breaks

Worth being straight about the limits, because the people who’ve leaned hardest on this feature are also its loudest critics.

Instruction-following is a probability, and it drops as conversations get long. The OpenAI community forum has years of threads on this, and a November 2025 post titled "Custom Instructions Are Useless" is a fair sample of the frustration: “What is the point of having custom instructions on personalizations if they’re not being followed?” That user had explicit formatting rules in the box and watched the model wander off them mid-conversation anyway. I’ve been using AI daily since February 2023, and drift is the one complaint that has never fully gone away in that whole stretch, across every model generation and every vendor. A bigger box doesn’t fix drift, it gives your rules more surface area and better odds. Expect the brief to hold strongest in the first stretch of any chat, and expect to re-anchor with a one-line reminder in marathon sessions.

The 5,000-character tier is paid only. Free and Go users keep 1,500, so if that’s you, deploy sections 1, 4, and 6 of the template and hold the rest in your master doc for pasting when it counts.

And the box is one personalization layer among several. Memory collects facts about you passively, Projects carry their own context, and custom GPTs override the global brief entirely, so if an output surprises you, the explanation might live in a different layer than the one you edited. The Standing Brief earns its keep by being the layer you wrote on purpose, in a document you control, portable to any tool that gives you a place to paste it.

Recap

OpenAI more than tripled ChatGPT’s custom instructions capacity on July 15, from 1,500 characters to 5,000 on paid plans, and the expansion applies to existing chats immediately. The box was never meant to be a bio field, and at its new size it holds a proper Standing Brief: what you sell, who buys, what tools you run, how you write, what you’re focused on, and how the model handles gaps. Write the brief in a doc you own, deploy it to the box, prove it with the three-prompt before-and-after test, and keep your expectations calibrated on drift.

Building context once and reusing it everywhere is most of what separates operators who compound with AI from operators who start over every morning, and it’s the exact muscle we build inside whop.com/abra-ai, where the skill files and memory setups are already written for you.

P.S. If you’re working through this in order:

• Yesterday’s piece on Claude Reflect and the Context Rebuild Loop is the diagnostic half of today’s fix.

• The GoHighLevel scoped-edits prompts from Monday pair well once your brief is live.

• The two-labs-in-48-hours breakdown covers where agent work is headed next.

• The full archive lives at muddventures.substack.com.

Back in your inbox tomorrow.

Andrew

TL;DR: Anthropic shipped Reflect on July 9, a beta dashboard inside Claude’s Settings that shows what you’ve used AI for over the last 1 to 12 months: top topics, peak hours, task categories, and recommendations built from your own patterns. It’s free on every plan, it takes ten minutes to read, and the most useful thing in it is the task you keep re-explaining in fresh chats, because that task is a system waiting to be built.

This newsletter got researched and drafted this morning by a scheduled Claude task, the same setup I covered in the Work From Anywhere issue, so I have a running record of where my own AI usage concentrates without needing a dashboard to tell me. Most people don’t have that record, and until last Thursday there was no easy way to get one. Anthropic shipped it: Reflect, a beta dashboard that reads your chat history and hands you the usage report.

By the end of this you’ll know what Reflect shows, the one pattern worth hunting for in your own report, and how to promote that pattern from a chat you keep re-starting into a system that runs without you re-explaining it.

The pattern has a name worth keeping: The Context Rebuild Loop. It’s the cycle where you open a fresh chat, re-explain your business, your format, your preferences, get the output, and throw the setup away, then pay that same setup cost again three days later on the same task. Anthropic’s own product team built detection for it, Reflect watches for people who, in Engadget’s words, “frequently re-establish the same or similar context” and nudges them toward Projects. The loop is invisible while you’re in it, which is what makes a mirror useful.

• What shipped: a Reflect tab in Claude’s Settings (web and desktop) showing a summary of your usage, most active day, peak hour, total chats, and a topic breakdown with percentages.

• Who gets it: Free, Pro, and Max accounts in beta, with memory turned on.

• What it recommends: fluency suggestions built from your own patterns, like moving a repeated task into a Project or a custom skill.

• The move below: find your most-repeated task and promote it from chat to system in one sitting.

Who this is for: anyone using Claude more than a few times a week, and especially operators who suspect they’re solving the same problem from scratch every Monday.

What Reflect shows you

Open Settings in Claude on web or desktop and pick the Reflect tab, then generate your report. The default view collates your last month, and you can widen it to 3, 6, or 12 months. At the top sits a paragraph summary of what you’ve been working through, followed by your most active day, peak hour, and total chats, then a breakdown of your topics with a percentage on the ones you hit most. The last stretch is the interesting part: a set of recommendations grouped around the 4D AI Fluency framework Anthropic built with academic partners, generated from your own patterns rather than generic tips.

Ryn Linthicum, Anthropic’s head of wellbeing policy, told Engadget the intent behind it: “We were really intentional about building [the dashboard] with an eye toward how we can upskill people’s usage of Claude, not in a way that encourages them to spend more time with it, but instead enables them to get more efficient at meeting their goals.” There’s also a quiet-hours setting and a break nudge in there, and the dashboard periodically asks questions like “What’s one thing you want to keep doing yourself, even if Claude could do it faster?”, which is a better question than most productivity content asks.

If you generate a report and get nothing, memory is off, that’s the dependency. Reflect only reads memory-enabled history, skips incognito chats entirely, and leaves out the underlying files from connected tools, so an inbox summary might appear in your reflection while the source emails never do.

Walk away with: your report generated on the 3-month view, which is long enough to show patterns and short enough to reflect how you work now.

How to read it: hunt the Context Rebuild Loop

Read the report as an audit, a Spotify Wrapped skim wastes the ten minutes. The topic percentages and peak hours are trivia. The signal is repetition: the task that shows up week after week, phrased twenty different ways, each time in a fresh chat where you rebuilt the context by hand. Every one of those chats billed you a setup cost, and the report is the first tool that shows you the receipt.

Once the report is on screen, run this in the same session:

Based on my usage patterns, answer three questions:

1. What task have I brought to you most often in the last 3 months?
2. What context did I re-explain across those chats that never changed
   (business details, format rules, tone, constraints)?
3. If I could only systematize one recurring task this month, which one
   saves the most repeated setup, and why?

Reflect’s own recommendation engine is pointed at the same target. Igor Bonifacic at Engadget ran it against his real usage, repeated research chats tracking down executive statements for a story, and the dashboard recommended building a custom fact-checking skill, which then produced a source-and-confidence template for every claim. His verdict: “I’ll admit I found the template helpful, and it wasn’t something I would have thought to ask Claude to do on its own.” That’s the shape of the value, the report surfaces the system you didn’t know you were already running manually.

Walk away with: one named task, the unchanging context behind it, and a reason it’s the first candidate.

Promote one task from chat to system

A repeated task can land in three homes, and the report tells you which one fits:

Where your repeated task goes:

Same task + same background context every time
  -> a Project (context lives there once, every chat inherits it)

Same task on a calendar rhythm (weekly report, Monday review)
  -> a scheduled task (it runs without you opening a chat)

Same steps applied to different inputs each time
  -> a custom skill or saved workflow (the steps live once,
     the inputs change)

The one-sitting version: take the task from your report, paste the context you’ve been re-typing into whichever home fits, and run it once from the new setup while the old chats are still fresh enough to compare against. The output quality usually jumps, because context written once and deliberately beats context re-typed from memory at 4pm on a Tuesday. My whole publishing operation runs on the third category, and the setup cost was paid one time.

Walk away with: one task moved out of the Context Rebuild Loop, and the pattern for moving the next one.

Where this wobbles

• It’s beta, web and desktop only for now, mobile is coming later, and the time-spent metric doesn’t exist yet. Linthicum says that’s because Anthropic wasn’t tracking it internally, a metric the product team “didn’t want to maximize.”

• Memory has to be on, so the analytics come bundled with a privacy tradeoff some people have deliberately declined. Sensitive conversations surface only at a high level, health-integration chats stay out entirely, and Anthropic says reflection data isn’t used for other purposes, worth reading their privacy note yourself if that matters to your business.

• The mirror is sold by the company that profits from what you see in it. TechCrunch's Sarah Perez makes the case that “Reflect’s larger purpose is about shaping how users think about AI itself,” and that deeper workflow integration “helps retain users and discourage them from switching to competitors’ AI tools.” She points back to Gmail Meter in 2012, an analytics tool that doubled as a demonstration of how central Gmail had become. Fair on both counts. The retention motive and the usefulness both live in the same feature, so take the audit and leave the sentiment.

• The insights are only as honest as the history behind them. If your real repeated work happens in tools Reflect can’t see, the report understates your loop instead of revealing it.

Recap

Reflect is free, live now, and takes ten minutes: generate the 3-month report in Settings, ignore the trivia, and hunt the task you’ve re-explained twenty different ways, that’s the Context Rebuild Loop and it’s been billing you setup time all year. Promote that one task into a Project, a scheduled task, or a skill, run it once from its new home, and you’ve converted the report from a curiosity into a system.

If what the report shows you is a longer list than one task, and you want a second set of eyes on which systems to build first, that’s the work I do with operators on an AI Clarity Call at muddventures.com/book.

P.S. A few next steps if today’s issue was useful:

• The setup this newsletter runs on: Work From Anywhere Just Got Tested by Two AI Labs

• The first Operator’s Read: 3 quiet AI shifts, and what I'd do about each one

• Last week’s GoHighLevel piece on scoped AI workflow edits: blog.muddventures.com/p/gohighlevels-ai-builder-just-learned

• Operators comparing builds like these every day: whop.com/abra-ai

• New here? The full archive lives at muddventures.substack.com

Back in your inbox tomorrow.

Andrew

TLDR: GoHighLevel shipped a real upgrade to its Workflow AI Builder on July 11: name the exact actions or triggers you want changed, inside a workflow with fifty steps, and it touches only those steps. Below are two prompts to copy into your account, a checklist to run before trusting an AI edit on a live workflow, and where GoHighLevel’s own docs say a human still has to check the work.

GoHighLevel pushed “Targeted Edits in AI Builder” live on July 11, 2026. The line that stopped me: you can “provide exact copy for 20 of your 50 emails and AI Builder edits only those 20, leaving the rest unchanged.”

I look at every “describe it and AI builds it” feature the same way: fine, but what happens when I only want to change six things inside a workflow with forty? That question has kept most agency owners doing manual, action-by-action edits even after the builder shipped a year ago.

By the end of this you’ll have the exact scoped-edit prompt pattern to run on your own GoHighLevel workflows, plus the checklist worth running before you let AI touch anything live.

What shipped: name the exact actions inside a workflow and GoHighLevel edits only those, nothing else touched.

What’s below: two prompts ready to copy, one for scoped copy edits and one for bulk sender identity and pipeline swaps.

The wall this solves: call it the Workflow Rebuild Wall, the point where reopening every action by hand costs more time than the automation itself ever saved.

Where it still needs you: GoHighLevel’s own docs say AI can’t test a workflow yet, so the checkpoint habit still matters.

Generating a whole new workflow from a prompt is one thing, touching six actions inside an existing one without breaking the other thirty-four is a different problem entirely, and the old version of that problem is worth naming: call it the Workflow Rebuild Wall, the point where a workflow gets big enough, or gets reused across enough client accounts, that manually opening and retyping every action costs more time than the automation itself ever saved.

A pattern shows up constantly on the intake side of AI Clarity Calls: an agency owner running a dozen or more client sub-accounts, each cloned from the same template, finds out a “quick rebrand” means touching every action in every account, every time. Pacho Sanchez, who runs automation builds for clients at Agency Level 5, puts the aggregate time savings from a solid core set of GoHighLevel workflows at “a minimum of 20 hours per week in manual work” once they’re running. That’s one operator’s own read on his client work rather than an audited figure, and it’s the right order of magnitude for what’s at stake when editing gets faster.

Who this is for: agency owners and in-house operators running client or multi-brand workflows inside GoHighLevel, especially anyone managing workflows with fifteen or more actions across more than one sub-account.

What GoHighLevel Shipped on July 11

Workflow AI Builder has been able to generate a full automation from a prompt for a while now (“send a welcome email series when someone fills out my contact form” and it builds the whole thing, triggers and actions included), but the part that stayed clunky was editing an existing workflow with any precision, since asking it to change “the emails” might touch six actions when you meant two, or two when you meant six.

The July 11 update fixes the scoping. Name the actions you want changed, all of them, a set number, or specific ones, and GoHighLevel’s own release notes describe the update as scoped, applying changes only to the actions you name and leaving everything else in place. It ships with three specific bulk moves: copy edits across selected actions, pipeline stage swaps across all or specific actions and triggers, and sender identity (From Name and From Email) across selected email actions.

What I look for when any vendor ships an “edit anything with one prompt” feature is where the scoping breaks. This is the first version of that promise I’ve seen from GoHighLevel that names the boundary up front instead of leaving you to find it by accident, and that’s the difference between “AI, rebuild this” and “AI, change these six things and nothing else.” For anyone who’s managed more than a handful of client workflows, that’s most of the ballgame.

The Scoped Copy Rewrite

The most common wall operators hit is copy, a client rebrands, an offer changes, or the review-request text has sounded like it was written in 2019 for two years running, and now you’re opening ten, twenty, or fifty individual actions to fix the wording one at a time.

Open the AI assistant inside your workflow builder (the sidebar icon in the workflow editor) and give it a scoped instruction instead of a vague one:

Update the SMS copy in only the review-request and no-show-follow-up actions.
New tone: warmer, first-name personal, no exclamation points.
Keep every other action untouched. Show me a preview before saving.

What correct output looks like: GoHighLevel returns a preview showing only those two actions with new text, everything else in the workflow marked unchanged, and once you open the workflow after saving, every wait step, tag, and other action should read the same as it did before you ran the prompt.

The failure mode is a vague version of this same prompt, something like “update my SMS messages to sound friendlier,” with no named actions, and GoHighLevel’s own support docs back this up, recommending you name the workflow settings, channel, and scope explicitly. An ambiguous prompt is when the built-in Clarifying Agent has to guess or ask follow-up questions, and a wrong guess on a live workflow is not where you want to find that out.

Walk away with: a tested, scoped prompt pattern you can run the next time a client rebrand or offer change means touching more than two or three actions.

The Bulk Sender Identity and Pipeline Stage Swap

This one is for anyone managing more than one client, brand, or sub-account. Sender identity and pipeline stage assignments are two of the most tedious things to fix by hand across a workflow, because they’re buried inside individual action settings instead of living in one central place.

Set the From Name to [Business Name] and From Email to [reply@business.com]
across every email action in this workflow.
Then move all triggers currently pointing to the "New Lead" pipeline stage
to "Qualified Lead" instead. Leave SMS and task actions unchanged.

What correct output looks like: every email action shows the new sender identity, and every trigger or action that referenced the old pipeline stage now references the new one, and nothing in the SMS or task actions moved. GoHighLevel’s release notes describe this as “reliable scoping,” meaning changes apply only to the set you name with no spillover into actions you didn’t touch. That claim is worth testing on a duplicate workflow before you believe it on a live one.

The failure mode shows up when pipeline stage names aren’t unique or consistent across accounts, which is a common problem once an agency has cloned the same template across a dozen sub-accounts with slightly different naming along the way. If “New Lead” doesn’t exist under that exact name in a given sub-account, the instruction has nothing to grab onto, and you’ll either get a clarifying question back or, worse, silence, so check your naming conventions before running bulk swaps across multiple accounts.

Walk away with: one instruction that replaces opening every email action to fix a sender name, and every trigger to fix a pipeline reference, one at a time.

The Checklist Before You Trust It on Anything Live

Before you run a scoped AI edit on a live workflow:
1. Duplicate the workflow. Edit the copy, not the original, on the first pass.
2. Count the actions in scope versus total actions in the workflow.
3. Name the exact actions in your instruction, or say "all" explicitly.
4. Screenshot the before state.
5. Run the edit, then diff the result against the screenshot, action by action.

I’d run the same duplicate-first check on any AI agent that touches a live system, whether that’s this workflow builder, a CRM record, or a client account, and the habit is simple: duplicate before you touch anything, verify the diff, and publish last, not first. It’s small, and it’s the whole difference between a five-minute fix and a support ticket you write yourself.

Where This Still Breaks

GoHighLevel’s own documentation for the AI Builder lists this under Beta Limitations, in their words: “manual review required, verify triggers, actions, and configurations before publishing,” and more directly, “AI cannot test workflows, perform manual tests.” The vendor is being straightforward here, scoped editing catches the “touched the wrong action” mistake, but it doesn’t catch a workflow that runs fine on the surface while the wrong logic sits underneath it.

Mari, who runs GoHighLevel training at Automated Marketer, tested four AI-built workflows in detail and landed on a fair verdict: “the AI builds fast but not perfectly”. Her catch is worth flagging: on a lead-qualification workflow with conditional branching, the AI “did get a little broad on how it evaluated the conditional,” setting a check to a general text-field match instead of the specific survey answer, so the branching structure was right and the condition itself just needed a person to tighten it.

That tracks with what happens any time a system gets handed more autonomy, the structure gets faster and the judgment calls still need someone watching, and it’s a smaller, lower-stakes version of a tension that’s shown up in every “AI agent, but with an approval gate” release this year. I wrote about that same shape behind Anthropic’s Cowork and OpenAI’s ChatGPT Work rollouts in the Approval Leash piece, in the full newsletter archive, and scoped editing is a narrower slice of the same idea: let the AI touch only what you named, then look before you publish.

The other honest limit is access, this lives behind an agency-level Labs toggle, so if you’re inside a white-labeled sub-account and don’t see “Build with AI” in your workflow builder, your agency provider probably just hasn’t turned it on yet, and it’s worth asking them directly. That toggle is also why a scoped edit won’t touch your published workflow the moment you run it: GoHighLevel shows a preview before anything saves, and checkpoints let you roll back with one click if something looks off after you do save it.

Recap

GoHighLevel’s AI Builder can now edit only the actions you name inside an existing workflow, instead of forcing a full rebuild or a vague full-workflow edit. The two prompts above cover the most common uses, scoped copy rewrites and bulk sender identity or pipeline stage swaps, and running both on a duplicate first, with the checklist keeping the edit honest, is the whole habit. GoHighLevel’s own beta docs are clear that AI still doesn’t test the logic for you, so the manual review step doesn’t disappear just because the edit got faster, and the same holds if you’re not on GoHighLevel at all: Zapier’s Copilot and HubSpot’s workflow AI are moving the same direction, and naming your scope in plain language instead of a vague instruction is the control lever regardless of platform.

The operators who feel this fastest are the ones running the same core workflow across a dozen or more client sub-accounts, each with its own branding, sender identity, and pipeline names, and that’s the spot where the old way, open every action in every sub-account one at a time, turns a ten-minute rebrand into a lost afternoon. A solo operator running three workflows probably isn’t there yet, the time savings show up hardest once a single workflow crosses ten or fifteen actions or gets cloned across accounts, and below that line manual editing is still fast enough that this isn’t the real bottleneck. Abra AI’s workflow-building skill files cover this same scoped-edit pattern across other tools as well, GoHighLevel included, if you want the habit to travel with you wherever you build, worth a look at whop.com/abra-ai if that’s the wall you’re staring at right now.

I’m curious where the line falls for most of you. Reply with your workflow’s action count if you want to find out whether you’ve hit the Rebuild Wall yet.

P.S. A few places to go next:

• The full newsletter archive, including the Approval Leash issue on keeping a human checkpoint on AI agents: muddventures.substack.com

• Abra AI’s workflow-building skill files, if the scoped-edit habit is one you want to carry across tools: whop.com/abra-ai

• If the real bottleneck in your funnel is what happens after a call gets booked: showtime.muddventures.com

• If the fix needs a full systems audit instead of one workflow prompt: muddventures.com/book

Back in your inbox tomorrow.

Andrew

TL;DR: Apple sued OpenAI, its hardware unit io Products, and two former Apple employees on July 10 for trade secret theft. The complaint reads like a thriller: a forgotten laptop, a “LOL” text, a Chief Hardware Officer accused of running the operation. The more interesting story is what happens eighteen months before a lawsuit like this gets filed, and why California’s unusual employment law makes trade secret claims the sharpest tool a company like Apple has left. Below: what the complaint actually alleges, a plain-English primer on how trade secret law works and why it exists, and my own opinion on who’s right (I’m Team Apple, with caveats). Plus what this signals for anyone whose business depends on a platform relationship that could sour.

Apple filed a 40-page lawsuit against OpenAI on July 10. Most of the coverage stayed on the parts that read like a thriller: a forgotten laptop, a text message that opens with “LOL,” a Chief Hardware Officer accused of running the operation from the top. I read the complaint and the reporting around it, and I think the trade-secret claims, real as they might be, are the smaller story here.

By the end of this you’ll have my actual read on what this lawsuit signals about where the AI industry is headed. You’ll also have enough working knowledge of trade secret law to follow the case yourself as it plays out in court over the next year. Not a checklist, more an executive-level take on a fight that’s bigger than the two companies filing it.

What’s alleged: Apple says former employees, including its ex-hardware chief, systematically pulled confidential product information for OpenAI’s hardware push.
What most coverage missed: this lawsuit lands eighteen months after Apple and OpenAI were partners, and six months after Apple quietly picked Google over OpenAI for its own AI.
The legal backdrop most readers don’t know: California bans employee non-competes almost entirely, which is exactly why trade secret law carries so much weight in cases like this one.
My take: a company doesn’t sue a rival it isn’t worried about. This is a confidence problem dressed up as a legal one.
Where this leaves operators: a reminder that vendor alliances in this industry have a shorter shelf life than the contracts built on top of them.

A quick primer: what actually makes something a trade secret, and why this is a California specialty

Before getting into what Apple alleges, it’s worth understanding the legal machinery underneath it, because it explains why this kind of lawsuit is so common in Silicon Valley specifically.

Under both the federal Defend Trade Secrets Act (signed into law in 2016) and California’s own trade secret statute, something only counts as a trade secret if it clears two bars. First, it has to derive real economic value from not being publicly known, meaning a competitor would actually benefit from having it. Second, the owner has to have taken reasonable steps to keep it secret: locked file servers, restricted access, NDAs, exit interviews that revoke credentials. A hardware roadmap, an unreleased prototype’s design specs, or internal manufacturing test procedures all clear that bar easily. A general skill someone picked up on the job, like knowing how to run a good design review, does not.

To win, Apple has to prove three things: a trade secret existed, Apple took reasonable measures to protect it, and it was acquired or used through improper means rather than independent invention. That last piece is where the “LOL” text message and the unreturned laptop actually matter. They aren’t colorful filler for a filing. They’re the evidence Apple needs to clear the “improper means” bar.

Here’s the part that makes California specific. Unlike most states, California voids nearly all employee non-compete agreements outright, under Business and Professions Code Section 16600. A 2024 update went further, making it a separate legal violation for an employer to even include one in a contract. Practically, that means a company like Apple cannot stop a departing engineer from joining a direct competitor the next day, no matter how senior or sensitive their role was. Trade secret law is what’s left. It’s the one legal lever California employers have to stop specific confidential material from walking out the door. They have almost no power to stop the person who holds that knowledge from walking out the door too. That distinction, information versus knowledge, is the entire game these lawsuits are fought over.

This isn’t the first time Silicon Valley has had this exact fight. In 2017, Waymo sued Uber and engineer Anthony Levandowski, alleging he downloaded roughly 14,000 confidential files on self-driving LiDAR technology before leaving to found a startup Uber then acquired. That case settled five days into trial, with Uber handing Waymo about $245 million in equity. Levandowski was later criminally charged, pleaded guilty to one count of trade secret theft in 2020, and was sentenced to 18 months before receiving a pardon in the final hours of the first Trump administration. Apple v. OpenAI is following a similar shape: a departure, a competitor building the same category of product, and a filing that leans hard on internal messages as proof of intent. It’s too early to know if the outcome looks anything like Waymo’s, but the legal template is a familiar one.

What Apple’s complaint alleges

Apple sued OpenAI, its hardware unit io Products, and two former Apple employees, Tang Tan and Chang Liu, in federal court in the Northern District of California, per TechCrunch’s report on the filing. Tan spent 24 years at Apple, most recently as VP of product design for the iPhone and Apple Watch, before leaving to help found io Products with Jony Ive. OpenAI acquired io for $6.5 billion last year and made Tan its Chief Hardware Officer. io is named in the suit. Ive is not.

The most vivid detail belongs to Liu, an eight-year Apple engineer who Apple alleges never returned his company laptop and later found a bug giving him ongoing access to Apple’s internal file servers. He messaged a former colleague: “LOL, I found out I can access the [network storage], so funny,” Bloomberg’s Mark Gurman reported via Fortune. Apple’s filing calls the pattern systemic: “at every level, from members of its Technical Staff to its Chief Hardware Officer… OpenAI has been stealing Apple’s trade secrets and confidential information,” and describes OpenAI’s hardware business as “rotten to its core by its illegal reliance on misappropriated trade secrets.” OpenAI’s response, through a spokesperson: the company has “no interest in other companies’ trade secrets” and is “focused on building innovative technology that empowers people everywhere.” More than 400 former Apple employees have joined OpenAI’s hardware division, per Fortune’s reporting.

That last number matters for reading the case correctly. Apple isn’t alleging that 400 people stole something. Under the legal standard above, hiring hundreds of people away from a competitor is completely legal, and expected in an industry this small. The complaint is narrowly built around specific documents and specific system access tied to two named individuals, which is exactly the kind of surgical claim that survives a motion to dismiss. A broader claim about talent flight alone wouldn’t.

The part I think matters more

Rewind eighteen months. In 2024, Apple and OpenAI announced a partnership putting ChatGPT inside the iPhone. That was the headline at the time: two of the most valuable brands in tech, aligned. Then OpenAI bought Jony Ive’s design studio and started building hardware of its own, explicitly aimed at the category Apple has owned since 2007. Then, in January of this year, Apple quietly signed a $1-billion-a-year deal to run Siri and Apple Intelligence on a custom Google Gemini model instead. ChatGPT became a peripheral option rather than the engine under the hood. Six months after that snub, Apple is in federal court accusing its former partner’s leadership of systematically raiding its talent and its confidential product data.

I don’t think the interesting question is whether Liu downloaded files he shouldn’t have. I think the interesting question is why a company as controlled and press-shy as Apple decided a public lawsuit was the right move here, instead of a quiet settlement or an even quieter internal fix. Companies with real leverage tend to negotiate in private. Companies that feel a genuine platform threat go public, because the lawsuit itself is a signal, to investors, to talent, and to OpenAI, that Apple is willing to fight in the open. Sam Altman has said openly that OpenAI wants to build the device that replaces the smartphone. Apple has spent two decades making sure nothing replaces the smartphone. That’s the actual fight. The trade secrets are the evidence, not the motive.

Where I actually stand on this

I’ll say the quiet part. I’m Team Apple here. Not blindly, the company’s a little past its peak right now, but it’s still a great company through and through. I’ve read both the Steve Jobs biography and Jony Ive’s. The thing that comes through in both is how obsessive Apple has always been about its own design language, doing things Apple’s way. It refuses to ship something that doesn’t feel like Apple, even when that costs time or money. That obsession is the actual moat, not the chips, not the retail stores, the taste.

Say the allegations hold up. Say trade secrets really did make their way into OpenAI’s hardware roadmap with help from people who used to sit in Apple’s own design reviews. I don’t think that’s close. That’s not competition. That’s copying the homework with the answer key someone walked out the door with, and Apple has every right to make an example out of it in open court.

I also don’t think that cancels out the deterrence angle I raised above, and I don’t see that as a knock against Apple for having it. Wanting to slow down a well-funded rival that’s actively poaching your design team is a completely valid business reason to litigate. I’d bet it plays a healthy role in the decision to sue right alongside the actual IP concern. Both things can be true at once. Apple can be genuinely wronged and strategically motivated to make this loud.

The honest tradeoffs

This is one side’s complaint, filed by the party with the most to lose from OpenAI succeeding in hardware. OpenAI denies wrongdoing, and none of the named individuals have responded publicly as of this writing. Nothing here is proven in court, and complaints are written to tell the most damning possible version of events.

Talent moving between competitors is normal, legal, and how this industry has always worked, and California’s ban on non-competes exists specifically to protect that mobility. Apple’s complaint is careful to draw the line around specific documents and system access, not the plain fact that hundreds of its former employees now work at OpenAI. Courts have not been shy about dismissing trade secret claims that amount to “our former employee is now good at their job somewhere else.” If Apple’s evidence turns out to be thinner than the filing suggests, this case could go the same way.

My read on the motive, the confidence-problem framing, is an interpretation, not a fact Apple has confirmed. Apple’s public statement sticks to protecting its IP. I’m connecting dots they haven’t officially connected, and my own Team Apple lean means I’m reading the ambiguous parts of this story in Apple’s favor. A reasonable person could read the same eighteen-month timeline and conclude Apple is using a legitimate legal claim to slow down a competitor it fumbled the partnership with, rather than the other way around.

Where I land

Strip away the AI hardware angle and this is a familiar story. A partnership that made sense when both companies needed something from each other stopped making sense the moment their roadmaps started pointing at the same prize. Call it the Alliance Half-Life, the shrinking window between “strategic partner” and “named defendant” once two companies realize they’re actually building toward the same platform. Eighteen months, in this case. I’d expect that number to keep shrinking as more AI labs decide the real prize isn’t the model, it’s the device people carry.

If you’re building any part of your business on top of a single AI vendor’s platform, a plugin ecosystem, an API, a partnership that felt stable last year, this is worth sitting with. Not because you’ll get sued. Because alliances in this industry are proving to be a lot more temporary than the roadmaps built on top of them assume.

I’ll be watching what OpenAI actually files in response, and whether this becomes the template other AI labs and Big Tech incumbents start reaching for as their roadmaps collide over the next few years. If it is the template, this is the first of many.

If you want to talk through how dependent your own stack is on any single AI vendor’s continued goodwill, that’s a real conversation worth having on an AI Clarity Call, grab a slot at muddventures.com/book.

Reply and tell me if you’re Team Apple on this one too, or if you think I’m cutting them too much slack.

Andrew

P.S. If the theme of keeping control over what you don’t fully own resonates, that’s the same thread running through the Approval Leash post from last week, just applied to a different kind of dependency. Come hang out in the Abra AI community if you want more of this kind of breakdown. And if this is the first issue of mine you’ve read, the archive lives at muddventures.substack.com.

TLDR: On July 7, Anthropic put Claude Cowork on mobile and web, so a background task can run while your laptop is closed. On July 9, OpenAI answered by merging Codex into ChatGPT and launching ChatGPT Work, an agent that turns a goal into a finished spreadsheet, deck, doc, or website instead of a chat reply. Both are usage-metered, not flat-fee. Pick one workflow you already know cold, run it with approvals switched on, and measure it against your actual hours before you schedule anything recurring.

“Work from anywhere” has been a slogan for a decade. This week it became a testable claim. This newsletter got written by an agent running inside Claude Cowork, on a schedule, before I was at my desk. That’s not a metaphor. I’ve been running Cowork through Dispatch as a daily tool for about two and a half, three months now, and it’s the literal infrastructure behind the issue you’re reading right now. So when Anthropic pushed Cowork out to phones and browsers this week, I wasn’t reading a press release about someone else’s tool. I was reading about the thing that already runs part of my business.

Then two days later, OpenAI answered.

By the end of this you’ll know what each launch actually ships, not the marketing description. You’ll know which one to pilot first depending on how technical your team is, and the one guardrail I’d never turn off no matter which agent you pick.

A few things worth flagging up top:

• Neither of these is a better chatbot. Both are agents that take a goal and work for hours without you watching. Both hand back a finished artifact: a sheet, a deck, a doc, a live web page.

• Both bill by usage, not by seat. Nobody published per-task prices. Budget the first week like an experiment, not a subscription.

• The tester numbers in both launches come from the vendors. Real names, real workflows, real self-reported results. Still the vendor’s own case studies. Treat them as hypotheses, not proof.

Who this is for: any operator running a small team who already delegates one recurring, multi-step task to a person. A report, a competitor scan, a monthly deck. You’re deciding whether to hand the first draft of that task to an agent instead.

The 48 hours that mattered

Anthropic’s move landed first. Claude Cowork launched as a desktop app back in January, built to feel like Claude Code without the code. On July 7, Anthropic expanded it to web and mobile for Max subscribers. The pitch is simple: start a task from your desk, get a status update on your phone, and come back to a finished output even if your laptop is closed the whole time. Anthropic’s own example: “Set Monday’s client prep for 6am: Claude works through the email threads, transcripts, and recent news, builds the briefing doc, and leaves the follow-up email drafted but unsent. Review it over coffee.”

I can vouch for the part about the laptop staying closed. I ran Dispatch on my phone for 20 straight days this summer on a trip to Switzerland, with the host device where the actual work was running sitting 6,000 miles away back home. Zero issues the entire trip. That’s the pitch Anthropic is making to everyone else this week. I’d already tested it at the most inconvenient distance I could put between me and my desk.

Two days later, on July 9, OpenAI answered with ChatGPT Work, an agent built on the newly released GPT-5.6 with Codex technology built in. Same week, OpenAI merged the standalone Codex app into one ChatGPT desktop app. Chat, Work, and Codex now live in one place, on every plan including Free. OpenAI also announced it’s sunsetting the standalone Atlas browser, folding those agentic-browsing features into ChatGPT itself.

Two labs, the same week, converging on the same bet: the fight isn’t about who has the sharper chatbot anymore. It’s about who owns the place where the actual work gets done.

What “ships finished work” actually means

Regular ChatGPT and regular Claude answer a question in the moment. Both of these products do something different. You give them an outcome, not a prompt, and they gather context from your connected tools, plan the steps, and keep working, sometimes for hours, without you sitting there.

Cowork’s early data backs up what that looks like in practice. Anthropic sampled 1.2 million anonymized Cowork sessions across more than 600,000 organizations over two weeks in May. The biggest category, at 33.4%, wasn’t coding. It was what Anthropic calls “business process operating”: pulling scattered updates into one report, building onboarding checklists, reconciling spreadsheets, the stuff that’s part of a lot of jobs but rarely anyone’s actual title. Content creation and copywriting came in second at 16.4%. Software development, the thing Cowork’s ancestor was built for, was 8.7%.

ChatGPT Work is chasing the same territory from the coding side. OpenAI says Codex already had 5 million weekly users and, more tellingly, more than 1 million people were using it for work that had nothing to do with software before Work even had a name. The new agent connects to more than 1,400 plugins and runs in Plan mode, proposing a step-by-step plan you approve before it touches anything. Its output format of choice is now “Sites,” a live web page instead of a static document. Sites update themselves as the underlying data changes.

Real numbers from real early testers

The launch materials name real people at real companies, which is more than most product announcements bother with. Worth reading with one caveat attached: these are vendor-arranged case studies, not independent audits.

Angela Ferrante, Head of Enterprise Marketing at Zapier, used ChatGPT Work to trace lead journeys across HubSpot, Gong, and email. Before, inspecting a single lead properly took her team 35 to 45 minutes, which means most leads never got that inspection. She put the result plainly: “That helped us identify and hand off seven figures in pipeline every month to sales.”

Nathan Bolt, Head of Digital Products at Virgin Atlantic, ran competitor customer-journey benchmarking that used to take his team weeks per cycle. His read: “A competitor analysis cycle that would normally take weeks now takes hours, helping us move from insight to product decisions much faster.”

On the Cowork side, one small business owner described it this way in an independent review. “I’ve been using Claude Cowork daily, and this is the first time an AI tool has genuinely changed how my workday flows,” they wrote. “Task queueing is the real unlock.”

Walk away with: three real, named examples of the exact workflow class both products are best at right now: recurring reporting, lead or customer-journey triage, and the monthly deck nobody wants to build by hand.

Pick your pilot workflow

The move: point one of these agents at one recurring task you already know intimately, not a reorganization of how your team works.

Here’s the filter I’d run before picking a first workflow:

FIRST AGENT PILOT, PICK ONE

1. Do you already know the current hours-per-cycle for this task?
   If you can't name the number today, you won't be able to
   measure whether the agent actually helped. Pick a task you
   can time first.

2. Is the output a document, sheet, deck, or web page,
   not an irreversible action?
   Good pilot: draft a competitor report, build a briefing doc,
   triage leads into a dashboard.
   Bad pilot: anything that sends money, deletes records,
   or emails a customer without a human reading it first.

3. Which team runs it, and which product matches?
   Non-technical team, wants pre-built workflows out of the box
   -> Claude Cowork (more on-rails, vertical bundles ship configured).
   Team comfortable connecting plugins and building its own flow
   -> ChatGPT Work (more flexible, steeper setup).

4. Can you afford a week of unmeasured usage while you find out
   what the task actually costs?
   Neither product publishes per-task pricing. Week one is a
   measurement week, not a rollout week.

What the correct output looks like: a finished draft you’d have been comfortable handing a new hire on their first week. Plus a real number for how long the agent took against how long the task used to take you.

The failure mode: skipping the timing step, loving the output, and scheduling the workflow to run daily before you know what a single run costs against your plan’s usage. The exact risk both product pages warn about in the fine print: a team burning a month’s included usage in the first week of enthusiastic use.

Walk away with: a four-question filter for choosing your first agent pilot, and a rule for what a pilot is allowed to touch before you’ve measured it once.

The guardrail I’d never turn off

Both products ship with the same control: a plan you approve before work starts, and check-ins you configure along the way. Call it the Approval Leash: the agent can run for hours and touch a dozen tools, but nothing it produces goes anywhere real until a person signs off.

OpenAI’s own language undercuts a little of its confidence here. The company reports that in adversarial red teaming, its auto-review system “blocked 100% of attempts to extract protected data, including attacks the reviewing model had not seen during training.” That’s a genuinely strong red-team result. It isn’t a guarantee that a production system can never leak client data. Keep your own approval gate on anything that touches a client system anyway, regardless of what the safety layer claims.

The honest tradeoff on the Anthropic side runs the other direction: cost, not safety. Anthropic users have spent a chunk of 2026 complaining about high token burn on the newer frontier models. An agent that works for hours unattended is exactly the kind of workload that turns a complaint into a real invoice. Watch the usage meter the same way you’d watch a contractor’s timesheet.

Recap

Anthropic put Claude Cowork on mobile and web July 7. OpenAI answered July 9 by merging Codex into ChatGPT, launching ChatGPT Work, and starting to sunset the standalone Atlas browser. Both products take a goal instead of a prompt and hand back a finished artifact instead of a chat reply. Both bill by usage, not by seat, and neither has published what a task actually costs. “Work from anywhere” stopped being a slogan and started being a feature two different companies shipped in the same 48 hours. Pick one recurring task you already know the hours on, run it with approvals on, and keep the Approval Leash attached no matter which agent does the work.

FAQ

Do I need a developer on staff to use either of these? No. Cowork ships pre-configured vertical workflows aimed at non-technical operators. ChatGPT Work leans on its plugin directory and Plan mode, which takes a little more setup but doesn’t require code.

Which one is cheaper? Neither company has published per-task pricing. Both meter usage against your plan’s included allowance the way Codex already did, so the honest answer is: you find out in week one, not before.

Can I run this on client data? Both offer admin controls and audit trails built for that use case. Keep a human approval step on anything touching client systems regardless of the vendor’s own safety claims.

What if my team already uses Zapier or Make for automation? Nothing here replaces a working automation. These agents are best at the one-off or recurring analytical and drafting work a person currently owns, not at wiring two apps together.

Reply and tell me which one you’re piloting first, Cowork or ChatGPT Work. I’ll compare notes with you directly.

Andrew

P.S. If you want help wiring your first agent pilot into the tools you already run, the skill-building side of this conversation happens inside whop.com/abra-ai. Related reading: Google Rewired Its Productivity Suite on the same “AI moves into where work happens” pattern from a different vendor. More at muddventures.substack.com.

Canva picked the biggest advertising stage in the world to stop calling itself a design tool. On June 25 at Cannes Lions, George Howes, who runs Canva Grow, walked through the 2.0 launch. AI ad creation for static and video, direct publishing to Meta, TikTok, and LinkedIn, one dashboard for every live campaign, cross-platform reports, and automatic new variations generated from whatever’s already winning. All of it inside the Canva login your team already has.

I spent years inside the version of this workflow that Canva just collapsed. At the agency I co-founded, creative lived in the design tool or with a designer, and publishing lived in separate ad managers. Reporting lived in a spreadsheet somebody updated on Fridays, usually late. The gap between “this ad is fatiguing” and “here’s the new batch” was measured in weeks, and agencies bill for that gap every month.

That’s why I’d put this launch in the same file as the Meta Ads CLI story from April: the tools that used to justify hiring a vendor keep getting pulled into software an operator already pays for. Same pattern I named Zapier Optionality when Notion did it to automation tools. This time it’s the ad workflow.

By the end of this you’ll know what shipped, the 30-minute test I’d run with one connected ad account, and how to tell whether your creative retainer still earns its line on the invoice.

What’s ahead:

• What actually shipped June 25 and the four acquisitions Canva stitched together to build it.

• The Refresh Retainer gets a name, because the thing agencies charge monthly for just became two product features.

• The 30-minute test with a copy-paste checklist and a verdict key for your next renewal conversation.

• What’s still shaky, including the dependency question nobody at Cannes wanted to raise on stage.

What actually shipped on June 25

Here’s the concrete list, pulled from Canva’s announcement:

AI ad creation. Drop in a website link and Grow pulls business info, product visuals, brand colors, and audience signals to generate static and video ads. A new Magic Layers integration exports AI-generated ads into the regular Canva editor as editable designs, so a human can fix what the machine got wrong.

Bulk Publish. Push ads directly from Canva to Meta, TikTok, and LinkedIn in one workflow. This works for ads made in Grow, in the Canva editor, or uploaded from anywhere else. No more exporting, re-uploading, and re-entering the same campaign three times.

Launch Dashboard. One view of every campaign running across all three platforms, so the “log into three ad managers to see what’s live” morning ritual goes away.

Multi-Platform Ad Insights and Reports. Performance reporting across Meta, TikTok, and LinkedIn in one place, with custom reports you can share without touching a spreadsheet.

AI Ad Tagging. Ads get automatically analyzed and tagged so you can see which themes, hooks, formats, and creative elements drive results across big ad sets. Worth flagging now: this one is only available on Canva Business and Enterprise plans. Canva put the smartest layer behind the highest tiers.

Automatic Refresh Generation. Grow reads live performance data and generates new ad concepts and variations from what’s already working. This is the feature the rest of the launch exists to feed.

Rollout started June 25 across North America, Australia, and the UK, with more markets coming over the next few months. Canva’s product page says Grow is available on all plans including Free, with limits on connected ad accounts, per the hands-on breakdown at Vijay Talks AI.

The backstory matters as much as the feature list. Canva bought MagicBrief in June 2025 for the creative analytics, the tech Howes founded. Then it folded in Ortto for customer data, SimTheory for AI assistants, Doohly for digital out-of-home, and MangoAI for creative optimization, four acquisitions in twelve months. Canva’s B2B revenue passed $500 million, 95% of the Fortune 500 uses it somewhere, and a16z ranks it the third most-used AI platform in the world. This launch is that whole shopping spree turned into one product.

The Refresh Retainer just became a feature

There’s a name for what got commoditized here, so let’s give it one: The Refresh Retainer. It’s the monthly fee where the real deliverable is a loop. Watch the performance data, figure out which creative elements are carrying the account, produce new variations of the winners, and ship them before the old ones fatigue. Plenty of agency and freelancer retainers are 80% this loop, dressed up as strategy.

Howes said the quiet part on stage: “For too long, creative and performance have lived in separate systems. With Canva Grow 2.0, businesses can go from generating engaging ads to publishing them across multiple platforms, seeing what’s working, and automatically refreshing creative based on what’s actually driving results.”

AI Ad Tagging plus Automatic Refresh Generation is the Refresh Retainer as software. The tagging layer answers “what’s working,” and the refresh layer produces the next batch from it. Keith Kirkpatrick at Futurum called the launch “a direct assault on the inefficiencies of fragmented marketing technology stacks,” and his firm’s survey of 830 software buyers found 44% now rank AI capabilities as a top purchase criterion. The demand side is already leaning this way.

Early operator reaction is warm. James Graver, who runs brand and portfolio marketing at AG1 and worked with Canva as a design partner on Grow, said “we’re excited about what it means for our creative workflows as we scale into new markets.” AG1 is the profile this serves: heavy paid social, constant creative turnover, more markets than the creative team can hand-feed.

The operators this hits hardest run $2,000 to $50,000 a month in paid social and pay somebody, an agency, a freelancer, or a full-time hire, mostly to keep fresh variations flowing. That line item deserves a fresh look this quarter.

The 30-minute test I’d run this week

Don’t take Canva’s word for any of this, and don’t take mine. The whole thing is testable with one ad account and half an hour. Here’s the exact sequence:

1. Go to canva.com/canva-grow and connect ONE ad account (Meta first,
   it's your densest data)
2. Open Launch Dashboard and confirm your active campaigns appear
3. Open Insights & Reports, filter to the last 90 days, sort by cost
   per result
4. Write down your top 2 ads and your 2 most fatigued (frequency
   climbing, CTR sliding)
5. Run Automatic Refresh Generation on your best ad
6. Export one variation to the Canva editor and fix whatever the AI
   got wrong
7. Publish nothing yet. Put the batch next to the last refresh you
   paid for and compare quality, speed, and cost

What a good result looks like: the dashboard numbers reconcile with what Ads Manager shows when you spot-check two or three metrics. The generated variations keep your actual product shots and brand kit intact, and at least one is something you’d put real budget behind.

What a bad result looks like, and what it means: if the reporting numbers don’t match Ads Manager, trust Ads Manager and treat Grow’s reporting as directional until it reconciles. If the variations come back generic, feed the brand kit and real product photos in and regenerate once. Still generic? The creation layer isn’t ready for your account yet, so use Grow for publishing and reporting only and keep your current creative source. That’s still a real win, it just changes which invoice you’re re-examining.

Then run the verdict:

KEEP PAYING   -> the refresh batch is clearly worse than what your
                 current creative source delivers
RENEGOTIATE   -> the batch is 80% as good and your retainer's main
                 deliverable is variations of existing winners
GO HYBRID     -> keep humans on new concepts and brand work, move
                 refresh production into Grow

Walk away with: a side-by-side read on whether your creative refresh loop is still a retainer or already a button.

What’s still shaky

The launch coverage was glowing, so here’s the other side of the ledger.

The single-door problem. Shashi Bellamkonda, an analyst who has tracked the Canva acquisition run all year, framed the risk cleanly: “Canva is asking a quarter billion users who trust it for design to now trust it with their advertising spend.” Grow sits on top of Meta, TikTok, and LinkedIn APIs that Canva doesn’t control, and those platforms change API terms whenever it suits them. His test question is worth stealing: if a platform changes access terms next quarter, do you still have a publishing workflow that doesn’t route through Canva?

No Google Ads. Meta, TikTok, and LinkedIn only. If search is your main channel, this launch changes nothing for you yet.

The smart layer is gated. AI Ad Tagging, the part that tells you which creative elements drive performance, requires Business or Enterprise. On Free and Pro you get the workflow consolidation without the deepest insight layer.

It’s a newly stitched stack. Grow 1.0 launched in October 2025, and 2.0 is four acquisitions welded together nine months later. Expect seams. Reconcile the reporting against your ad platforms for at least a month before you trust it for decisions.

It won’t replace deep campaign control. Bidding strategy, attribution modeling, and complex account structures still live in the native ad managers. Grow compresses the creative-to-report loop, and that’s the honest scope of it.

Recap

Canva Grow 2.0 shipped June 25 and pulls ad creation, publishing to Meta, TikTok, and LinkedIn, cross-platform reporting, and performance-based creative refreshes into the tool most operators already pay for. The Refresh Retainer, the monthly fee whose real deliverable is new variations of winning ads, just became two product features. The move is a 30-minute test with one connected account, then a verdict on your creative line item before the next renewal. Go in with eyes open about the single-vendor dependency, the gated tagging layer, and the missing Google Ads support.

Sorting out which tools in your stack still earn their invoice is a big part of what I do with operators on AI Clarity Calls. Consolidation questions like this one are the right size for a first conversation.

Reply with what your creative refresh loop costs you per month if you run paid, I read every reply.

Andrew

P.S. If this landed, these connect directly: the Meta Ads CLI issue on the same compression pattern hitting media buying, and the Zapier Optionality issue on platforms absorbing their neighbors. This week’s Operator’s Read covers the quiet shifts stacking up this summer. The Abra AI community is where I share the builds behind these issues. And if someone forwarded you this, muddventures.substack.com gets you the next one.

TLDR: Three separate startups launched the same product in the first week of July: tools that show businesses whether ChatGPT, Gemini, Claude, and Perplexity recommend them. One raised a €10 million seed round doing it. The pitch lands because most businesses have never once asked an AI what it says about them. You can run that first check yourself tonight, free, with three prompts. This issue gives you the exact audit, how to read what comes back, and the questions that separate a real vendor from a snake-oil retainer.

Monday's startup funding roundup had a pattern I've been waiting to see. Three companies launched the same product in the same week without knowing it: Foundin.ai in the Netherlands, GeoSurge in London, and Visiblie in Belgium, all building tools that show businesses whether they appear when someone asks an AI for a recommendation. GeoSurge closed a €10 million seed round on July 1. Visiblie raised €500K the next day. In StartupHub's words, "none of them appear to know the others exist."

I pay close attention to this lane because I build in it. Counterclaim, my skill pack for fixing what AI engines say about a business, exists because of the same shift these three startups just raised money on. Back in May I wrote about AI Visibility Drift, the gap between what your business actually is and what the answer engines say it is. What's new this month is the vendor layer forming on top of that gap. When three companies ship the same product in one week, the sales emails start landing in operator inboxes about six weeks later. Digiday reports GEO pitches are already flooding media execs' inboxes. Yours is next.

Here's what the pitch decks won't lead with: the first and most useful thing every one of these tools does is ask the AI engines about your business and show you the answer. That part is free. You can do it tonight.

By the end of this you'll have a 20-minute audit that produces a dated snapshot of what ChatGPT, Gemini, and Perplexity say about your business, a verdict system for reading it, and a four-question filter for any vendor who calls.

What's ahead:

• The myth this category is priced on: your Google ranking tells AI engines a lot less than you'd think, and there's 75,000-brand data on it.

• The 20-minute self-audit: three prompts, three engines, one dated document.

• Three verdicts and the fix for each: including the one I'm naming today, because half the businesses that run this audit are going to hit it.

• The vendor filter: four questions that collapse a snake-oil retainer pitch in one call.

Who this is for: operators whose customers ask ChatGPT or Perplexity for recommendations before they ever hit Google, which at this point means most local services, agencies, consultants, and B2B firms with a sales cycle.

The myth the whole category is priced on

The myth: if you rank well on Google, the AI engines already know you and recommend you. So AI visibility is either handled or hopeless, and either way there's nothing to do this quarter.

The data says otherwise, and it comes from an unlikely skeptic. Ahrefs, a company that sells traditional SEO software, studied 75,000 brands to find what actually correlates with getting mentioned by ChatGPT, Google's AI Mode, and AI Overviews. The classic SEO signals came back weak. Domain Rating, the authority score agencies charge you to raise, correlates with ChatGPT mentions at just 0.266. Backlink volume barely registers. Total pages on your site: almost nothing, around 0.194. Publishing more content for volume's sake does basically zero for AI visibility.

What correlated strongest surprised me when I first read it. YouTube mentions, at roughly 0.737 across all three AI surfaces, beat every other factor they tested. Any time your brand name shows up in a video title, transcript, or description, that's a signal. Branded web mentions came second at 0.66 to 0.71: your name appearing in articles, guides, forums, and directories, whether or not anyone links to you. The engines learned about the world partly from YouTube transcripts and web text, so the businesses that get talked about are the businesses that get recommended. Being talked about and ranking on Google are related, but they're very much not the same job.

One more finding worth holding onto: ChatGPT showed the weakest pull toward established brand authority of the three surfaces Ahrefs tested. For a business without a household name, it's the most open door. Google's AI Mode sits at the other end, acting like a consensus engine that mostly repeats whoever's already big.

So the myth cuts both ways. Your page-one ranking doesn't carry over the way you'd assume, and your lack of a big brand doesn't lock you out the way you'd fear. Which means the only way to know where you stand is to ask.

The 20-minute audit

The move: ask the engines about your business the way a customer would, from a clean seat. Open ChatGPT, Gemini, and Perplexity. Use a logged-out window or a fresh chat with no memory of you, because your own account has context that a stranger's doesn't.

The exact prompts. Run all three in each engine, nine answers total:

1. What are the best [your service] providers in [your city or market]?

2. I'm looking for [the specific thing you sell, phrased like a buyer:
   "a marketing agency for a home services company doing $3M"].
   Who would you recommend and why?

3. What do you know about [Your Business Name] in [city]?
   What do they do, and what is their reputation?

Paste all nine answers into one document. Put today's date at the top. That date matters more than it looks, because this snapshot is the baseline every future check gets compared against.

What a healthy result looks like: you show up unprompted in at least some of the recommendation answers, and when you're named directly in prompt 3, the engine describes your actual services, your actual market, and doesn't confuse you with anyone else. The description reads like a knowledgeable colleague summarizing you.

The failure mode: running it once, getting one bad answer, and treating it as a verdict. These engines are probabilistic. The same prompt can produce different answers an hour apart. One absent answer means nothing. A pattern across nine answers means a lot. If you want to be careful, run the set twice and keep both.

Walk away with: a dated nine-answer snapshot of what the answer engines tell your prospects about you.

Three verdicts, and the fix for each

The move: score each of the nine answers with one letter, then count.

A = PRESENT AND ACCURATE: named in recommendations, described correctly
B = PRESENT BUT WRONG: named, but services, market, or reputation off
C = ABSENT: not mentioned, or the engine says it doesn't know you

What the scorecard tells you. Mostly A: you're in maintenance mode, re-run monthly and watch for drift. A mix with B: you have a correction problem, which is exactly the AI Visibility Drift pattern from May, where the engines are working from stale or third-party information about you. Mostly C is the one that deserves a name, so I'm giving it one.

Institutional Absence is when the answer engines have no confident story about your business at all. Not a wrong answer, no answer. You ask prompt 3 and get a hedge, a guess, or a different company with a similar name. The engines aren't against you. They've simply never absorbed enough independent signal about you to say anything. Based on what I see when operators run this for the first time, absence is more common than distortion, and it's invisible until you look, because nothing in your Google Analytics tells you about the recommendation that never included you.

The fix lane, per verdict. For B, correction: tighten the sources engines actually read, meaning your Google Business Profile, your directory listings, consistent descriptions of what you do across every page that names you, and follow-up where third-party sites describe you wrong. For C, the Ahrefs data hands you the priority list. Get your name into video: guest spots on local or niche YouTube channels, recorded talks, even client walkthroughs, because low-view videos still count when the mentions are wide. Earn genuine text mentions: trade publications, local press, supplier case studies, community guides. And aim at ChatGPT first, since it's the surface least gated by brand size.

The failure mode: treating this like a week-long project. Mentions accumulate over months. An operator who starts now is buying position for Q4 and next year, not for next Tuesday. The other failure is buying a retainer to fix what's actually a listings problem you can clean up yourself in an afternoon.

Walk away with: a verdict letter and the single fix lane that matches it.

When paying a vendor actually makes sense

The category is real, and so is the snake oil forming around it. Jeremy Moser, who runs the SEO agency uSERP, gave Digiday the line I'd frame on the wall: "If a GEO service does not openly tell you that success in AI visibility is 80 percent good fundamental SEO, they are selling you snake oil." Lily Ray, VP of SEO at Amsive, put the vendor wave in context in the same piece: "We've all lived through this a million times, and that's why it's been frustrating for us." Her point is that AMP and featured snippets each spawned the same cottage industry of specialist vendors before getting absorbed back into ordinary search work.

There's also a hard structural limit the sales deck glosses over. Per Digiday's reporting, these tools don't have access to the real prompts people type into AI engines. They simulate queries with synthetic data and work backwards from outputs. That's a reasonable method, and it's also an estimate, sold with a dashboard's confidence.

The move: before signing anything, make the vendor answer four questions.

1. What share of your recommendations is fundamental SEO
   I might already be paying someone else for?

2. Do you see real user prompts, or do you model them synthetically?

3. Show me one client: what exactly did you change,
   and what moved in the 90 days after?

4. If I stop paying you, what happens to the visibility you built?

What a good answer sounds like: a real one will echo Moser unprompted, admit the synthetic-data limit, and point at durable assets like mentions, listings, and content that keep working after the contract ends. Where a vendor genuinely earns the fee is scale: dozens of locations, hundreds of prompts tracked weekly, competitive categories where manual checks can't keep up.

The failure mode: any guarantee of AI mentions. The engines are probabilistic and nobody controls their output. A guarantee on a system the vendor doesn't control tells you everything about the rest of the pitch.

Walk away with: a four-question filter that ends most of these sales calls inside ten minutes.

The honest tradeoffs

The audit is a snapshot, and the engines move. Answers shift by model version, by phrasing, by day. That's the Engine Drift problem wearing a different coat, and it's why the dated document matters more than any single answer.

AI visibility also isn't traffic, at least not yet. Ahrefs' own numbers show ChatGPT carries about 12% of Google's search volume while Google still sends 190x more clicks to websites. What AI answers drive today is the shortlist: who gets considered, who gets called. That's worth real money in high-ticket services, and it's hard to attribute in any dashboard you currently run.

And the correlation caveat is real. Ahrefs is careful to say YouTube mentions correlate with AI visibility; nobody has proven they cause it. The fix lanes above are the best-supported bets available, and they're still bets.

Recap

Three startups launched the same AI-visibility product in one week, which tells you the vendor wave is coming. The category prices itself on a myth, because Google rank and AI mentions are loosely related at best. The free move is the nine-answer audit: three prompts, three engines, one dated document, one verdict letter. B means correct your sources. C means Institutional Absence, and the fix is mentions, video first. Vendors earn their fee at scale, and the four questions above sort the real ones from the gold-rush ones.

If you run the audit and find the engines telling a wrong story, or no story, about your business, that's the exact job I built counterclaim.muddventures.com to handle, prompt by prompt, source by source.

FAQ

Do I also check Google's AI Overviews and AI Mode? Yes, same prompts. Just know the dynamics differ: Google's AI surfaces lean harder on established authority, so your existing SEO carries more weight there. ChatGPT is where an unknown brand has the fairest shot.

How often do I re-run this? Monthly, same prompts, same document. The trend line across snapshots is the real signal.

I run a local business. Does this matter yet? Foundin.ai built its whole product for local businesses, which tells you where the demand is. Your buyers are already asking these engines who to call. The volume is smaller than Google's, and the people asking are usually close to a decision.

Should I block AI crawlers from my site? If visibility is the goal, no. A blocked crawler can't learn what you do, and an engine that can't read you defaults to whatever third parties say, or to silence.

What if the AI says something flat-out false about my business? That's a corrections workflow: find the source it learned from, fix it there, then feed the engines updated signal. It's the core of what Counterclaim automates.

Tomorrow's issue is back in your inbox at the usual time. If you run the audit tonight, reply with your verdict letter, A, B, or C. I read every reply.

Andrew

P.S. If this issue hit, these go deeper: the original AI Visibility Drift breakdown on what Google's AI did to organic clicks, the Operator's Read on Engine Drift for why saved AI setups quietly change under you, a 2-minute AI IQ Test to see where your operation actually stands, and the Abra AI community where operators share the skill files behind builds like this. New here? Get the daily issue at muddventures.substack.com.

TLDR: Microsoft 365 got more expensive on July 1, and the reason is AI. The upside buried in that hike is that a capable AI chat now ships inside the base plan you already pay for. So this is the week to pull your usage reports, figure out what you’re really paying per person who actually opens each AI tool, and cut or downgrade the seats that are billing you for silence. I’ll walk the exact audit below.

If you run a business on Microsoft 365, you probably got the email. Your renewal bill went up on July 1, some plans by a little, some by a lot. Business Basic moved from $6 to $7 a seat, Business Standard from $12.50 to $14, and the frontline plans got hit hardest, with one version climbing 43% once you strip Teams out (Windows Latest has the full table). Microsoft calls it a packaging and pricing update. Windows Latest called Copilot “the AI tax on businesses,” and that phrase is doing a lot of work.

By the end of this you’ll have a 20-minute audit that shows exactly which AI seats you pay for that nobody opens, and a simple test for whether the now-included free tier already does the job you’re paying $30 a head for.

The price went up because Microsoft folded AI and security features into the base tiers, which means every affected plan now includes the built-in Copilot chat with inbox and calendar awareness plus Word, Excel, and PowerPoint helpers. You’re paying more, and part of what you’re paying for is an AI tier that used to sit behind a separate charge. For the last three years I’ve watched the free layer inside these tools quietly get good enough that the paid add-on stops earning its keep, and this Microsoft change is the clearest version of that I’ve seen.

Look past the sticker price. What you pay per person who actually opens the tool usually runs two to three times higher, because most of the seats sit idle.

The free tier just moved. The same price hike that annoyed you also bundled in an AI chat that covers a real chunk of what the paid add-on does.

Renewal timing is the whole game. Most of this money can only be cut on your renewal date, so the audit is worthless if you run it after you re-sign.

Who this is for: any operator paying per seat for Microsoft 365 Copilot, ChatGPT Team, or any AI add-on across a team of five or more. The bigger your headcount, the more this is worth.

Name for the thing: the AI Seat Tax

The AI Seat Tax is the per-person premium you pay for AI add-ons and standalone AI seats, multiplied across a team where only a fraction of those people ever open the tool. Microsoft’s own adoption data is the cleanest example. Across enterprises, Copilot activation averages around 35.8%, which means for every 10 seats you buy, roughly 3 or 4 get used and the rest sit idle while you pay full freight (Peafowl IT breaks the math down). Their line: “only 36% of Copilot users are actually using it,” and “at $30/user/month, that’s $115K wasted yearly on a 500-seat rollout.”

You’re probably not running 500 seats. Take a 25-person shop on Business Standard that also bought 25 Copilot add-ons at $30 a month. That’s $9,000 a year on the add-on alone, and if a third of the team ever opens it, you’re really paying about $75 a head for the people who use it and full price for the silence of everyone else. Almost every operator I run a cost audit with has some version of that sitting on the books, and the seat line is where the easy money almost always is.

Step 1: See what you’re actually paying per person who uses it

The move is simple. For every AI tool you pay per seat, pull the last-30-days active-usage number and divide your monthly spend by the people who actually showed up, not the people you bought seats for.

For Microsoft 365 Copilot, the usage lives in the Microsoft 365 admin center under Reports, then Usage, then the Microsoft 365 Copilot report (some tenants see it inside the Copilot Dashboard in Viva Insights). It shows enabled users versus active users per app. For ChatGPT Team or any other per-seat AI tool, the vendor’s admin panel has a members list with a “last active” column you can export.

Once you’ve got the export, you don’t have to eyeball it. Paste it into the AI and let it do the sorting:

Here is a CSV export of our AI tool seats and last-active dates.
Columns: name, tool, monthly_cost_per_seat, last_active_date.

Today's date is [DATE]. Do three things:
1. Flag every seat with no activity in the last 30 days as "dead."
2. For each tool, calculate cost per ACTIVE user (monthly spend divided by seats used in the last 30 days).
3. Give me a table sorted by total monthly waste, highest first.
Keep it to the table plus a one-line summary. No preamble.

The correct output is a short table where the “cost per active user” column is visibly higher than the sticker price, and a “dead” list you can act on. If the cost-per-active-user number comes back roughly equal to the sticker, you have high adoption and there’s nothing to cut here, which is a real and fine answer.

Where it goes wrong: the usage dashboards undercount. They often log activity for some surfaces and miss others, so a person who uses Copilot inside Outlook but never inside Teams can read as “inactive.” Don’t cut on a single bad month, and don’t cut a seat you can confirm someone uses somewhere.

Walk away with: a ranked list of exactly which AI seats are dead and what each active seat really costs you.

Step 2: Run the substitution test against the free tier that just leveled up

For the seats that are getting used, ask a narrower question: is the paid version doing something the now-included free tier can’t. That test got a lot more interesting on July 1, because the built-in Copilot chat that ships with your base plan now handles inbox and calendar awareness and basic Word, Excel, and PowerPoint help. A year ago that was thin. It isn’t anymore.

Go person by person on the active seats and ask what they actually use the paid add-on for. Draft an email, summarize a thread, clean up a spreadsheet, pull notes from a meeting. Then check whether the built-in chat already covers that specific job. A quick way to force the comparison:

TOOL | WHO USES IT | THE ONE JOB THEY USE IT FOR | DOES THE FREE BUILT-IN CHAT DO THIS? | VERDICT
Copilot add-on | Sarah (ops) | summarize long email threads | yes, mostly | downgrade, test for 2 weeks
Copilot add-on | Mike (finance) | build formulas + pivot in Excel | not deeply | keep
ChatGPT Team | 6 seats | general drafting | overlaps free tier | consolidate to 2 heavy users

The correct output is a verdict per seat: keep, downgrade, or consolidate. Keep the seats where the paid tool does deep work the free tier can’t touch, like heavy in-Excel analysis or grounded answers across your company files. Downgrade the ones where someone’s paying $30 to do a job the bundled chat now does. Consolidate the tools where you’re buying six seats of the same capability across two overlapping products.

The failure mode here is cutting on a demo instead of a trial. The free tier looks close in a 5-minute test and then falls short on the fourth real task of the week. Don’t cancel anything on day one. Downgrade one or two seats, run them for two weeks against real work, and let the person tell you if they hit a wall.

Walk away with: a keep / downgrade / consolidate call on every active seat, backed by the one real job that seat does.

Step 3: Right-size before your renewal date

This is the part people skip, and it’s the part that actually saves the money. Most of these seats are on annual or monthly terms you can only change at renewal, and Microsoft’s packaging changes roll through by August 1 with a 30-day notice in your Message Center. So the audit has a clock on it.

Pull every AI subscription’s renewal date into one line. For each one, take your Step 1 dead list and your Step 2 verdicts and set the new seat count you want to land on. Then put a reminder two weeks before each renewal to make the change, because the default is silent auto-renew at the seat count you had last year.

The correct output is a single number: your new monthly AI spend after you drop the dead seats and downgrade the redundant ones. For that 25-seat example, trimming even 10 idle Copilot add-ons is $3,600 a year back in the business, and you lost nothing anyone was using.

Where this goes wrong: annual lock-ins. If you pre-paid a year of seats, you may not be able to drop them until the term ends, and reactivating later can carry friction or a price bump. Check the term before you count the savings, and if you’re locked, put the date on the calendar and hold the audit until then.

Walk away with: a renewal calendar with a target seat count and a save-this-much number next to each date.

Failure modes to watch

The audit is easy to get wrong in three specific ways.

You cut a power user. The people who actually use Copilot report real gains, on the order of several hours a week saved, so the goal is never to strip AI from the team. It’s to stop paying full price for the two-thirds who never log in. Protect the heavy users. Cut the ghosts.

You trust one month of dashboard data. Usage reporting lags and undercounts by surface. Look at 30 to 60 days, and when a seat looks dead, confirm with the person before you pull it.

You run the audit after you renew. The single most common way this saves nothing is doing it a week too late. Renewal date first, everything else second.

The honest part

The built-in Copilot chat is real, but it isn’t the full paid Copilot. For deep, grounded work across your own company files, or heavy Excel and PowerPoint building, the $30 add-on still does things the free tier can’t. This isn’t a “cancel everything” pitch. When Copilot is actually used, the returns are strong, and cutting a genuine power user to save $30 is the wrong trade. The whole point of the audit is to tell those two groups apart instead of paying the same price for both.

And the size of the prize scales with your headcount. At 5 seats this is a couple hundred dollars a year and a good habit. At 40 or 50 seats it’s real money, and it’s money you’re currently handing over for logins that never happen.

Recap

Microsoft’s July 1 price hike raised your bill and, in the same move, bundled a capable AI chat into your base plan. That makes this the moment to check the AI Seat Tax you’re carrying. Pull usage and find what each seat costs per active user, test the active seats against the free tier that just got better, then right-size before your renewal date. Protect the power users, cut the ghosts, and put the renewal dates on a calendar so the savings actually land.

FAQ

I’m a 5-person business. Is this even worth 20 minutes? Probably yes, once. The dollars are smaller, but stacked AI seats hit small teams too, and finding one dead seat pays for the coffee you drank running the audit. Do it once, then only revisit at renewal.

How do I see who’s actually using Copilot? Microsoft 365 admin center, then Reports, then Usage, then the Microsoft 365 Copilot report. Some tenants see it in the Copilot Dashboard inside Viva Insights instead. It shows enabled versus active users per app.

Microsoft raised my price and I never added Copilot. Why did it go up? Because the AI and security features got folded into the base tiers. The built-in Copilot chat and some Defender protections are now part of the plan, so the base price moved even if you never touched the paid add-on.

If I drop the $30 add-on, do I lose AI in Word and Excel entirely? No. You lose the deeper in-app Copilot, but the bundled chat plus the Word, Excel, and PowerPoint helpers that now ship with your plan give you a lighter version. Test that lighter version on real work before you decide.

Is ChatGPT Team the same problem? Same audit, same math. Any tool you buy per seat and pay for whether or not people log in belongs in this review.

Where the Mudd Ventures work fits

Most of what I do in an AI Clarity Call starts exactly here, with a map of what you’re paying for versus what your team actually runs, because the seat line is usually the fastest dollars and the clearest signal of where AI is stuck in your business. If you want a second set of eyes on the audit before your renewal, that’s the room for it.

P.S. A few earlier issues that pair with this one:

• When the built-in tool absorbs what you were paying extra for (the free-tier-ate-the-paid-tool pattern, applied to automation)

• The workflows that now ship inside the software you already own

• Want the audit run with you before renewal? muddventures.com/book

• Building the seat-cost math into a repeatable system is the kind of thing we trade in the Abra AI community

• Not subscribed yet? muddventures.substack.com

Reply with your seat count and which AI tools you stack, and I’ll tell you the first line I’d check.

Andrew

I read release notes for a living. Not because they’re fun. It’s because if you run any AI in your business, the ground under you moves every couple of weeks, and the operators who stay a step ahead are the ones who noticed the ground move.

Three shifts landed in the last two weeks. None of them got a keynote. All three change what an operator like you is paying for, wiring together, or trusting to run. Two of them are quiet wins. The third can quietly burn you.

I’ve started calling the third one Engine Drift: the model under a tool you already use gets swapped, upgraded, or retired by the provider, and your saved setup keeps running on top of the new thing whether you notice or not. The output can shift meaningfully even though you never touched a single instruction. The only real hedge is to re-test your builds on a schedule. More on that in a minute.

Here’s the short version before I dig in:

- GHL turned on their entire AI stack for free through the summer, so if you’re running on GHL, some of the standalone AI subs bolted on top just got redundant.

- Anthropic dropped multi-agent orchestration inside Claude, which means one job can run a team of agents (researcher, writer, QA) in a single call instead of a Zapier chain, and that’s a real crack in the middleware layer.

- OpenAI retired two models in June, GPT-5.2 on the 12th and GPT-4.5 on the 26th, so anything you built against those is now running on GPT-5.5 whether you told it to or not. That’s Engine Drift.

GoHighLevel turned on its AI stack for free

I’ve had probably fifteen conversations with GHL operators this year about their AI stack, and the pattern’s always the same. They’re running GHL for CRM, funnels, workflows, all of it, and then they’ve bolted a $59/mo Jasper seat on top for copy, a $99/mo Copy.ai for ads, sometimes a ChatGPT Team seat too, plus whatever writer they’re using for emails. Two hundred dollars a month easily, on top of GHL, for what usually adds up to “an AI that helps me write things.”

Last week they turned on Ask AI, AI Studio, Workflow AI, Funnel AI, and Email AI for every paid sub-account. Free. Through August. That’s five separate tools, native inside GHL, that overlap directly with what most operators were paying for on top.

The workflow one is the interesting one. You can drop an AI action inside a workflow now the same way you’d drop a webhook, which means your booking flow can enrich, draft, and send without you wiring three tools together. Small thing on paper, real cost reduction if you’re the operator who was paying for the enrichment tool plus the writer plus the tool that sends.

So here’s what I’d do this week if I were running on GHL. Pull up your subscriptions, and any AI writing tool that’s doing what one of those five now covers, cancel it. Then rebuild one workflow, probably the one that touches new leads, using the Workflow AI action instead of the Zapier or Make chain you had before.

The thing that gets me about this isn’t the money. It’s the pattern. The tool you already pay for keeps absorbing what you were buying separately, and I wrote about this in May when Anthropic embedded 15 workflows into apps you already own. GHL just did the same move for the CRM crowd. The line item disappears whether you cancel it or not, so cancel it.

Anthropic put a real crack in the Zapier bill

Anthropic ran Code with Claude a couple weeks back, and the piece that mattered wasn’t the marketing. It was multi-agent orchestration. You can build a job now that runs a small team of Claude agents in sequence, one researches, one writes, one checks, as a single call. Not a chain of Zapier steps calling three separate models. One job.

I’ve been trying to migrate a client’s lead-enrichment flow off Zapier for about six months. Standard mess: Zapier hits Apollo, then Clay, then a GPT step to write the intro line, then HubSpot. Twelve steps. About $180 a month in tool costs across everything, mostly because Zapier and Clay both bill on operations. The migration always died because rebuilding it in Claude Code meant writing custom orchestration for the agent handoffs, and that was more work than it was worth.

That’s the thing that just changed. The orchestration lives inside the model now, so I don’t have to write it. I write instructions for each agent (the researcher gets one, the writer gets one, the QA gets one), and Claude runs the team as one job. My best guess after playing with it for a few hours is that I can pull that whole enrichment flow into a single seat at maybe $200/mo total, which replaces about $180 of tool spend plus some of what I was paying the VA to babysit the workflow.

If you’ve got a workflow you built on Zapier or Make that stitches together three or four tools plus an AI step, this is the week to look at it fresh. Don’t rebuild everything. Pick the one workflow you touch most and see if a multi-agent Claude job can absorb it. My rule so far: if the workflow is more than half AI thinking and less than half moving structured data between tables, it probably belongs in Claude now. If it’s mostly moving data, keep it in Zapier.

The bigger point, and this is the one I keep coming back to when I talk to operators about their stack, is that middleware is thinning. Zapier isn’t dead, but the reason to pay for it just narrowed.

The models under your custom GPTs already changed

Now the one that can burn you.

OpenAI retired GPT-5.2 from ChatGPT on June 12, and GPT-4.5 on June 26, custom GPTs included. Anything that was running on either of those now runs on GPT-5.5. The instructions still live, and the engine underneath swapped.

That’s the trap. If you built a custom GPT in the last year and tuned it against a specific model’s behavior (the way it hedges, the way it formats, the length it defaults to), it’s running on a different engine now, and the same prompt can come back meaningfully different. Nobody sent you an email about it. The system just kept running.

I saw this happen with a client of mine last week. He runs a small services shop and has a custom GPT his team uses to draft quotes. He mentioned it was “off” lately, nobody had touched the instructions, and it turned out he’d tuned it back in the winter against a specific model that was gone. The outputs had drifted enough that his team was rewriting more than they used to, so he’d been silently paying that tax for weeks.

If you built anything against a specific model in the last twelve months (a custom GPT, an API call in a Zap, a pinned model string in a Make step), this is the week to walk through them and re-test each one against a known-good input. Not a new input where you can talk yourself into liking the output. A specific input where you already know what the good answer looks like. If the tone, format, or accuracy shifted, either update the instructions or pin a specific model that’s still available.

This is going to keep happening. Providers retire models on their own schedule, and your setup lives on top of theirs. The only durable move is to build a re-test into your calendar every couple months, or every time you notice output feels different, so Engine Drift can’t quietly compound.

The pattern underneath all three

Three announcements, three angles on the same shift.

The tool you already own is absorbing what you were paying for separately (GHL). Middleware is thinning (Anthropic). The engine under your saved setup can change without asking you (OpenAI).

What all three have in common, and this is the thing worth taking, is that your AI stack isn’t a set of tools you decided on. It’s a set of dependencies you’re renting. The provider can rearrange what’s inside them, absorb the layer above them, or retire the model under them. The job isn’t to pick tools once and forget them. The job is to re-audit them on a schedule so you’re not paying for something you don’t need, wiring together something that now runs in one place, or trusting an engine that got swapped.

I have this on my calendar every four weeks. Twenty minutes. I look at every AI line item, every workflow that stitches together more than three tools, and every custom GPT or pinned model string. Half the time I find nothing, and every once in a while I find a subscription I can cancel, a workflow that just got easier to build, or an engine that drifted underneath a build I’d forgotten about.

Three shifts, one habit. If you don’t already have “audit the AI stack” on a monthly calendar, put it there this week. It’ll pay for itself the first time you find one thing.

Andrew

P.S. Two threads from the archive if you want more on any of this:

The tools you already pay for keep absorbing features (the embedded workflow layer)

Notion just made Zapier optional (the middleware thinning trend, before this week’s evidence)

If you’d rather do this audit alongside other operators reading the same release notes, that’s the exact conversation we’re having in the Operator Council.

Reply and tell me what you found. I read every one.

The tool is Comet, Perplexity’s AI browser. If you spend any time in operator circles right now, you have heard some version of the pitch: the browser is becoming the place where an AI agent starts a task and finishes it for you, and whoever owns that surface owns the next decade. Maybe. What I want to give you today is the version of this I would give a client over coffee, because the hype and the reality are both real and they point in different directions.

For the last three years I have used AI every single day, and I have watched the same pattern repeat. A capability shows up, the demos look like magic, and then the gap between the demo and a safe daily workflow turns out to be the whole game. Comet is the cleanest example of that gap I have seen in a while.

Start with what it actually does well, because that part is not marketing.

What Comet is good at today

The honest wins are research and synthesis. You point it at a topic, it opens the relevant sources, pulls the key information, and assembles a structured summary inside the browser with citations you can click back to. A developer named Naresh B A wrote up an honest week with Comet and described asking it to find the best video tutorial on a topic: it compared several options, analyzed them, and opened the best one without him touching a tab (medium.com). For competitive research, pulling notes out of a long thread, or turning six open tabs into one brief, this is a real time save.

It is also a capable shopper and reader. Summarize this page, or find a product under a set budget across a few retailer sites. These lower-stakes, mostly-public-web tasks are where the tool earns its place in a workday.

Now the part the demos skip.

Where it gets slow and rough

Naresh’s review is useful precisely because he is not selling anything. When he asked Comet to draft and send an email, it took nearly five minutes, because the agent methodically analyzed the page, captured screenshots, and navigated the HTML step by step. His verdict on the rough edges: “more genius toddler than polished pro” (medium.com). That matches what I see. The agent will occasionally misread a button, open an extra tab, or stall on a complicated page. For a one-off task that is a curiosity. For a workflow you run thirty times a day, five minutes plus an occasional misfire is the line between a tool and a toy.

What I tell the operators I work with is that “it can do it in a demo” and “I can trust it to do this unattended on my real accounts” are separated by roughly eighteen months of engineering, and most tools in this category are still on the early side of that line.

The part nobody hyping this wants to dwell on

Here is the uncomfortable middle of the story.

The single most useful thing an agentic browser does, acting across every site you are logged into at once, is also the reason security researchers say it cannot be fully secured. For thirty years the web’s core protection has been the same-origin policy: the bank tab cannot read the Gmail tab. An AI agent operating with your logged-in credentials erases that boundary by design, because you handed it the keys.

The attack that exploits this is called indirect prompt injection. Someone hides an instruction inside a web page, a Reddit comment, a calendar invite, or a document, the agent reads it, and the language model cannot reliably tell your command apart from the attacker’s. In August 2025, Brave’s security team hid text inside a Reddit spoiler tag, Comet read it, followed the hidden instructions, and pulled out a user’s email address and a one-time passcode (brave.com). In March 2026, Zenity Labs demonstrated a zero-click version triggered by a malicious calendar invite, plus a path that lifted credentials out of a 1Password vault through the agent’s own authorized workflow (siliconangle.com). Enterprise testing by LayerX found Comet up to 85 percent more vulnerable to phishing and web attacks than Chrome (layerxsecurity.com).

I want to be fair here, because this is not a Perplexity-only failure. OpenAI’s competing browser, Atlas, has the same structural problem, and OpenAI itself wrote in December 2025 that prompt injection is “unlikely to ever be fully ‘solved’” in browser agents. Security researcher Simon Willison calls it the “lethal trifecta”: any agent that can touch private data, read untrusted content, and send information out can be turned into a data-exfiltration tool by a single injected prompt. Every agentic browser, by design, does all three of those things.

There is a legal cloud on top of the technical one. Amazon sued Perplexity in November 2025, arguing that Comet’s agent visiting Amazon’s logged-in pages with your credentials counts as unauthorized access under the Computer Fraud and Abuse Act. The Ninth Circuit heard oral arguments on June 11 and has not ruled yet (techtimes.com). Whichever way that lands, it tells you how unsettled the ground under this whole category still is.

What to do with this

The part that actually matters for an SMB owner is that none of the above is a reason to ignore the tool. It is a reason to use it the way you would onboard a sharp but brand-new assistant: hand them the research, keep them away from the checkbook until they have earned the trust. Here is how I would set it up this week.

First, install it in a walled-off profile. Run Comet as a dedicated browser that does not share saved passwords, payment methods, or active logins with the browser where you do your real email and banking. The damage an injected prompt can do is capped by what the agent can reach, so a profile with nothing sensitive in it is a small target.

Second, give it only research and reading jobs to start. Spend a week pointing it at public-web work: competitive scans, summarizing long reports, comparing vendors, turning a pile of tabs into a one-page brief. Notice where it genuinely saves you time and where it stalls. You will know inside five sessions whether it belongs in your week.

Third, keep your hand on anything irreversible. Every agentic browser has a setting that makes the agent pause before it buys, sends, submits, or changes a password. Leave that on. The cost of one confirmation tap is nothing next to an agent completing a purchase or sending a message you never approved.

If your work is research-heavy, Comet is worth the hour it takes to test. If you want an agent transacting on your real accounts unattended, the honest answer in June 2026 is that the tooling, the security, and the law are all still catching up, and a careful operator stays on the research side of that line for now.

The judgment call I spend most of my time on with the businesses I work with is figuring out where a tool safely fits in how you already operate, separate from how impressive it looks in a demo. If you want help mapping which AI tools earn a place in your stack and which ones are still demos wearing a product page, that is exactly what an AI Clarity Call is for. You can grab one at muddventures.com/book.

And if you just want to compare notes with other operators kicking the tires on this stuff before betting real workflows on it, come hang out in the Abra AI community at whop.com/abra-ai.

The browser that runs your whole business is coming. It is not here in June 2026, and knowing the difference between a useful copilot and an unattended employee is most of the edge.

Andrew

P.S. If a friend forwarded you this, you can get it straight to your inbox at muddventures.substack.com.