We sell a product in this category, and vendors like us are the last people you should trust on its limits. So this page relies on outside evidence wherever we can find it, and it ends with the limits of our own product.
These nine limits fall into three groups. Some are about being software and won't change. Some are weaknesses of today's models, which may narrow over time. And some come from how you've set up your data and permissions, which you can do something about now.
Things software can't do because it's software
These limits have little to do with model quality, and a better model next year won't remove them.
1. It can't earn trust or hold authority
When a chief of staff walks into a meeting and says the CEO needs this resolved by Friday, people move, because a colleague has spent months earning that standing. A message from a bot doesn't carry that weight. Bridgespan's guide to the role says the best chiefs of staff are respected by colleagues, and that leaders must be able to trust them implicitly. Software can flag a missed deadline. It can't make someone feel accountable for it.
2. It can't handle the hard human conversation
Telling a co-founder they're the problem, calming a lead who's about to quit, or noticing that a senior person has gone quiet in meetings all need presence and judgment. An AI can help you prepare what to say. Sending that message through a bot would make things worse.
3. It can't take responsibility
If an agent says something wrong to a customer, the company answers for it. In Moffatt v. Air Canada, a British Columbia tribunal rejected the airline's argument that its chatbot was a separate entity and found it liable for negligent misrepresentation. That's one tribunal ruling in one province, and this page isn't legal advice. The direction is still clear enough to plan around: "the AI did it" doesn't work as a defence, and your name stays on the email.
Things today's models get wrong
These are weaknesses of current systems. They may improve, but you should plan as if they're here to stay.
4. It can state false things with confidence
Adam Kalai and three co-authors argue that models hallucinate because training and evaluation reward guessing over admitting doubt. For you, that means a wrong number in an investor note will look just like a right one. Anthropic's Project Vend gives a vivid case: an agent running a small shop told customers to pay into an account it had made up.
5. It struggles with long, messy work
In TheAgentCompany, a simulated software firm, the most competitive agent completed 30% of tasks on its own. Simple tasks often worked, while longer and harder ones didn't. That's a 2024 benchmark, and newer models have probably moved the number, but we found no equivalent test that's more recent. The shape of the finding matches common sense: a two-minute summary is safer to delegate than a two-week project with changing facts.
6. It can overreach or be fooled
Anthropic's log of agent misbehaviour lists deleting remote branches after a misread instruction, and attempting migrations against a production database. The authors put these down to a model being overeager. Separately, content an agent reads can contain hidden instructions. OWASP says it's unclear whether fool-proof prevention of prompt injection exists. Its excessive agency entry describes a mail assistant tricked by an incoming email into forwarding sensitive messages to an attacker. An assistant that reads your inbox is exposed to this by design, which is why read access and send access should be separate decisions.
7. It can be talked into things, and AI managers don't fix that
In Project Vend, the agent was easily talked into discounts and giveaways. In the second phase, results improved a lot once procedures such as price checks were added, and the authors note they "rediscovered that bureaucracy matters". They also found the AI manager brought in to supervise "shared many of the deficiencies and blind spots" of the agent it was watching. So adding a second agent as a reviewer gives less protection than it appears to.
Things it can't know from your setup
8. It can't see what was never recorded
The fact that your lead investor is going through a divorce, that an engineer is interviewing elsewhere, or that a big customer only stays because of one friendship isn't in a system. A person might pick up on these things. A briefing that looks complete can hide this gap, because a tidy list gives no hint of what's missing from it. Before you trust a ranking, ask what it couldn't possibly have known.
9. It's only as good as the records you keep
If your pipeline is out of date, the AI will rank stale deals with confidence. If the cash number comes from a spreadsheet nobody updated, the runway warning will be wrong or missing. Tools can't fix a company that doesn't write things down, though they can make the gaps easier to see.
What an AI chief of staff cannot do, task by task
Use this as a practical sorting tool. We made these calls from the evidence above, and you should adjust them as you see how a tool performs on your own data.
| Task | Can it help? | Limit to keep in mind | Your check |
|---|---|---|---|
| Summarise yesterday's changes | Yes, a good fit | It can miss what isn't logged | Spot-check two items a week |
| Rank what needs you today | Yes, as a first pass | Rank order reflects settings and data, and not your full context | Ask why the top item is first |
| Draft an investor update | Yes, a good first draft | Numbers and tone can be wrong | Check every figure against the source |
| Send an email to a customer | Draft yes, unattended no | You're liable for what it says | Read it and approve it |
| Prepare a board pack | Partly | It can't choose what the story should be | You write the narrative |
| Deliver bad news to the team | Help with prep only | A message from software would damage trust | You do it in person |
| Resolve a dispute between two leads | No | No standing with either of them | You or a senior person |
| Decide who to fire | No | Legal, human and ethical stakes | You, with advice from people who can be accountable |
| Give legal, tax or accounting sign-off | No | It isn't a licensed adviser and can sound certain when wrong | A professional |
| Spot that morale has dropped | Weak signal only | Check-ins and surveys show part of it, and the rest is in the room | Talk to people |
How to work with these limits
- Keep a person on anything leaving the company. Review recipients and full text before sending. The rules for this are in human in the loop AI agents.
- Separate read access from write access. OWASP recommends the least privilege needed, and authorisation enforced outside the model, so a fooled agent still can't do damage.
- Spot-check its facts every week. Pick three claims and open the source records. If it fails often, stop relying on it until you find out why.
- Keep your records current. Assign one owner to the pipeline, the cash number and the task boards. Otherwise you're paying to automate bad data.
- Keep a human in charge of the people side. If you can't afford a chief of staff, that work falls to you, and software won't change that. See AI vs a human hire for how to split it.
Where the Nautis Chief of Staff stops
Everything above applies to our product as well. Here are the limits specific to it, as stated in its own guides.
- It only reads what's there. The briefing skips sources with no data, so a new or thinly used workspace gets a short list. It can look fine while missing a lot.
- It runs once each morning. The briefing appears at 7:00 am and stays the same until someone hits Refresh, so it won't react to something that happened at 11:00 am on its own.
- It's the company's day. The briefing is per organization and doesn't act as a personal assistant for each person.
- Approvals take attention. The default of asking every time means someone has to review each action. That's deliberate, and it means it isn't hands-off.
- Connected tools aren't copied in. Nautis calls actions in connected apps on demand and doesn't mirror their data, and some actions, such as those in connected apps, aren't available on WhatsApp yet.
- Credits are capped by plan. Chat, voice and custom advisors use AI credits, and sending is blocked when they run out until they reset or you top up.
- It's young. Nautis launched publicly in July 2026, so few independent reviews exist. Nobody has published a scored benchmark of it that we know of, so your own trial is the real test.
- It won't replace your professionals. It doesn't replace a lawyer, an accountant, a board or a human chief of staff, and it isn't an accounting system or a payroll provider.
FAQ
What can't AI chiefs of staff do that humans can?
They can't earn trust, carry authority with your team, handle sensitive conversations or take responsibility for a decision. They also can't know anything that was never written down. Those gaps are about being software, so better models won't close them.
Can an AI agent make business decisions on its own?
It can make small, reversible ones if you allow it, such as sorting items or creating an internal task. Anything that commits money, reaches outside the company or is hard to undo should go to a person. You stay responsible either way.
How accurate is an AI chief of staff?
We found no independent benchmark of AI chief of staff products, so nobody can give you a fair percentage. General research shows models can state false things with confidence, and one 2024 benchmark had the top agent finish 30% of office-style tasks alone. Test any tool against your own records.
Should an AI have access to my inbox?
It carries a real risk, because an incoming email can contain hidden instructions. OWASP's example is an assistant tricked into forwarding sensitive mail. Limit what it can send without review, and connect only tools from vendors you trust.
Sources
- Bridgespan: what a chief of staff is and when you know you need one (checked Oct 31, 2026)
- McCarthy Tétrault: Moffatt v. Air Canada, misrepresentation by an AI chatbot (checked Oct 31, 2026)
- Kalai et al.: why language models hallucinate (arXiv) (checked Oct 31, 2026)
- Anthropic: Project Vend, phase one (checked Oct 31, 2026)
- Anthropic: Project Vend, phase two (checked Oct 31, 2026)
- TheAgentCompany: benchmarking LLM agents on real-world tasks (arXiv) (checked Oct 31, 2026)
- Anthropic: Claude Code auto mode (checked Oct 31, 2026)
- OWASP: LLM01 prompt injection (checked Oct 31, 2026)
- OWASP: LLM06 excessive agency (checked Oct 31, 2026)