The agent that "closes sales" — the part the demo hides

On June 3, 2026, Meta launched its Business Agent globally. It isn't a chatbot that answers questions. It books appointments, qualifies leads, closes sales, and executes payments — around the clock, in the customer's language, wired into Shopify, Zendesk, and hundreds of other systems. Meta says over a million businesses are already using one. In the demo it's pure magic: a tireless salesperson that never sleeps and costs nothing to start.

The demo is the easy part. Here's the part it never shows you.

It's not a chatbot. It's an employee with your card and no judgment.

Strip away the polish and look at the shape. You've connected an autonomous agent to your business that can read messages from strangers (inputs you do not control), and act in your name — make promises, quote prices, close deals, move money — at machine speed, thousands of times a day.

That's not customer service. That's giving a new hire your company credit card, your calendar, and your checkout, then never reviewing what they do. Except the hire is a non-deterministic guesser that will, some fraction of the time, confidently say or do the wrong thing — and now the wrong thing is a refund, a discount it invented, a commitment you can't honor, or a customer's data sent somewhere it shouldn't go.

It's the same dangerous shape, sold as a product

I wrote about the year the agent became the attacker: the risky primitive is an autonomous actor with broad power, fed untrusted input, acting faster than any human can review. A sales agent on WhatsApp is exactly that. The "untrusted input" is every customer message — and a clever or just-confused one can steer it into doing something it shouldn't. What used to take a security researcher to set up is now a one-click product a million businesses plugged in this week.

The new part: you can't say "the AI did it"

Here's what changed, and it's concrete. The legal escape hatch just closed. California's AB 316, in effect since January 1, 2026, bars you from using an AI system's autonomy as a defense — if your agent causes harm, "it acted on its own" is not a defense. The broad legal consensus across 2026 is the same: the business deploying the agent bears primary responsibility. Autonomy redistributes accountability; it doesn't erase it. And lawyers keep pointing out that most companies' contracts don't cover the gap. So "let the agent close the sale" really means: I own every promise it makes, every refund it issues, every mis-sale and every leak — at scale, instantly.

The honest other side

This is genuinely valuable. A 24/7, multilingual agent that handles the boring 90% of customer conversations is a real win, and Meta does ship guardrails, controls, and metrics. The problem isn't agents doing things. It's doing them without treating the action surface like the legal liability it now is — wiring up "close the sale" with the same casualness as "answer an FAQ."

What to actually do

The fix is the discipline I keep coming back to, pointed at business actions:

• Ground it. The agent may state only computed or approved facts — your real prices, real availability, real policy. It must never invent a discount, a delivery date, or a promise. If the fact didn't come from your system, the agent doesn't get to say it.
• Scope the verbs, not just the words. Chatting is cheap and reversible. Booking, refunding, and paying are not. Gate every irreversible, money-touching action behind a limit, an approval, or a whitelist — the same way you'd never give a new rep unlimited refund authority on day one.
• Make it observable, and give it an owner. Someone's name has to answer for what it did at 2am. Use Meta's guardrails like the legal boundary they are, not a settings page you skim.

"Let the agent close the sale" is the most exciting sentence in the demo and the most expensive one in production. The agent is fast, tireless, and yours — which means its mistakes are fast, tireless, and yours too. Decide what it's allowed to actually do before you fall for how well it talks, because the law already decided who pays when it's wrong. It's you.