Hey there, fellow accidental techie! ๐
This issue is later than planned, and I want to tell you why. Colombia had a major earthquake last month. My family is okay. A lot of people I know are not.
Between that and other client work, most of my time these past few weeks went somewhere other than this newsletter. I've been working with my friend Santiago on mutual aid. He delivered medicine people needed right away, and he's been in a rural area called Yocoto helping since, working with 40 families and the local school, all affected by the earthquake.
If you want to help, email me and I'll send you Venmo or Zelle details directly.
Thanks for bearing with me. Here's the issue.
Another week, another AI headline. This time it's Google's turn: Gemini Spark, a 24/7 personal AI agent that works in the background, connects to your inbox, calendar, and files, and acts without you clicking through every step. It was announced back in May 2026, but not really rolled out until the summer more widely.
If you feel a little numb to announcements like this by now, that tracks. Something new drops practically every week, and somewhere there's an expectation that you have an opinion on it.
Sound like the answer to being stretched too thin? It might be. It might also be the fastest way to make a mistake at a scale you can't walk back.
Here's the question worth sitting with before you say yes to any of it. Not whether agentic AI works. Whether your nonprofit is actually ready to hand something autonomy over systems that hold donor and client trust. That's a harder question, and most organizations answer it after they've already turned the tool on, not before.
Spark just happens to be the one making headlines this month. Microsoft's Copilot agents, Salesforce's Agentforce, whatever your CRM or donor database vendor pitches you next quarter, they're all selling some version of the same idea: a tool that acts on your behalf instead of waiting for you to ask. The questions in this issue apply no matter which name is on the product.
You're not behind if you haven't figured this out yet. Nobody has. A survey of the sector this year found more than 90% of nonprofits are already using AI in some form, but close to half have no policy governing how. It's not a competence gap. Every organization is moving faster than its own guardrails, under adoption pressure nobody asked for.
What Changes With an Agent
An agent isn't the chatbot you've already gotten used to. You don't open a tab, type a question, and read an answer. It runs on its own, builds a model of how you actually work over time, and takes action instead of just drafting suggestions. That's the appeal. It's also the exposure. A tool that acts on your behalf is only as careful as the boundaries you set around it, and right now, most nonprofits haven't set any.
Take Spark as the concrete example, since it's the one sitting in your inbox right now. It currently only works with personal Google accounts, not yet available for work or school Workspace accounts, and a Workspace admin can't flip a switch to change that. Mixing a personal Google account with organizational data, donor records, case notes, anything with a name attached, is the same problem as taking confidential files home in a personal backpack because the office printer was down. It also runs on Google's paid tiers, starting around $20 a month per person. That matters if you're testing it on the org's dime or your own. Every agentic tool will come with its own version of this account-and-cost question. Ask it before you ask anything else.
The Boundaries That Actually Matter
Then there's the question of what any of these tools can actually see. Spark builds its usefulness by reading what you give it access to: Gmail, Drive, Calendar, sometimes whatever websites you're logged into. Other agentic tools work the same way, just against your CRM or case management system instead.
Nonprofits don't hold one kind of data. You've got public program information sitting next to major donor financials sitting next to intake notes on someone who trusted you, specifically you, with the worst week of their life. That person didn't agree to have an AI agent read their file. An agent doesn't know the difference unless you draw the line first. The real question: does this task need the whole inbox, or just one folder? That's the principle of least privilege, and it applies here the same way it applies to any staff member's system access. Least-privilege access limits how much damage a mistake does. It doesn't protect against the agent being manipulated by something malicious buried in an email or page it reads.
Here's what raises the stakes on getting those boundaries right early. Most agentic tools, Spark included, let you build reusable routines that run again without you re-explaining them, scheduled to repeat on their own. That part is genuinely useful: a weekly pull of action items from a planning document, a recurring scan of a shared inbox for anything that needs a response. It's also the thing that turns a one-time mistake into a repeating one, and a subtler risk than most people expect. These tools carry memory across tasks. Get one instruction wrong, and the agent doesn't just make that mistake once. It can carry the wrong assumption into the next task, and the one after that, quietly, until a person happens to notice.
Every one of these tools is designed to pause before certain actions, purchases, anything it flags as sensitive, and ask for your approval. But "sensitive" is the vendor's definition, not yours. An automated draft email to a colleague on your team is nothing. An unreviewed message to a major funder is a different category entirely, and no agent has a way to know that unless your organization has already decided where that line sits.
Automation without a defined human-in-the-loop just makes the same mistake faster, at a scale you didn't intend.
Is Your Process Even Ready?
None of this works if the underlying process is a mess to begin with. An agent builds a persistent model of how you work and replicates it, chaos included. Before handing off any workflow, ask one question: could you hand the documented version to a brand-new employee and expect them to run it correctly on day one? If the honest answer involves "well, it depends" more than a couple of times, that process isn't ready for a human backup yet, let alone an autonomous one. Handing a shaky process to an agent speeds it up. The mess just moves faster, with less oversight than before.
None of this is an argument for sitting this one out entirely. It's an argument for sequencing. The organizations that get real value out of tools like these are the ones that let trust build in small, contained steps.
Where to Start
Start small, this week.
Pick one task that touches nothing sensitive: a cluttered personal inbox, a draft meeting agenda, a first pass at action items from a planning document. Test it on a personal account only, never one connected to your organization's systems. Success looks like exactly that: the task got done correctly, and nothing with a donor or client's name attached was anywhere near it.
Over the next two to three weeks, run a simple data classification pass on one real workflow before it goes near any AI agent. Sort what that workflow touches into three buckets: public, internal, or sensitive. Internal means staff-only logistics like a meeting agenda; sensitive means anything with a name, address, or account number. Write down, in one sentence, where your organization's line sits. Success looks like a workflow you could point to and describe exactly what it's allowed to see, and what it's never allowed to touch.
Before scaling any of this, put your human-in-the-loop rule in writing. Name two or three action types that always require a person to click send: anything going to an external funder, anything involving money, anything that deletes or shares client data. You don't have to start from a blank page for this one. NTEN has a free AI policy template, linked below, that you can adapt in an afternoon instead of drafting from scratch. Success looks like a one-page rule any staff member could follow without needing to call you first to ask if it's okay.
None of this requires a dedicated IT department or a budget line that doesn't exist. It requires knowing what you're protecting before you decide how fast to move, whether the tool in question is Gemini Spark, Copilot, Agentforce, or whatever launches next.
Did you know I do this work outside the newsletter too?
โFlourish Collective is my fractional operations practice, senior-level support for nonprofits on exactly this kind of decision, without the cost of a full-time hire. Reply if that's useful to know or write me at hugo@flourishcollectivellc.com
Has your organization tried anything like this yet, or are you holding off until there's more clarity? I want to know where people are actually landing on this one. Reply and tell me.
P.S. Issue 19 digs into a closely related problem: what happens when the person who understood all your systems gives two weeks notice, and what you do when the knowledge holding a process together walks out the door, human or otherwise.
Until next time,
Hugo
Join the Waitlist
A 6-week cohort program for nonprofit professionals ready to stop firefighting and start shaping technology strategy.
Join the waitlist for early access and beta pricing.
|
โ