AI agents for car dealerships are AI tools that follow a multi-step process on a schedule and act across your systems, such as tracking a used car through recon or reviewing BDC calls. Start with one real problem, limited access, and a named owner.
Last updated: October 22, 2026
We were talking with a client not long ago about reconditioning used cars, and their problem had nothing to do with chatbots. Cars came in, went into recon, and got stuck. The process stepped through multiple software applications because the car passed through different departments, so nobody had visibility across all of it, and a car going from recon to the showroom just took too long. Sound familiar? It should.
That’s a perfect job for an AI agent. You don’t need a robot that talks to customers for it. What you want is something that looks at those systems first thing every morning, spots the car that hasn’t moved since Thursday, and pings whoever can get it moving. Boring work. Real money, though.
I used that example in a DealersEdge webinar on AI governance on October 12, alongside two others, and the questions dealers ask about agents tend to land in the same three places. What can they do? Where do we start? Who’s in charge once one is running? This post takes them in that order. It sits under our larger guide to AI governance for dealerships, because an agent is the point where governance stops being a policy document and turns into a real question about access.
What an AI Agent Actually Does at a Dealership
An AI agent is software that carries out a series of steps on its own, on a schedule or a trigger, using access you give it to your systems. It reads, decides what matters, and acts, often by alerting a person or updating a record, without someone typing a prompt each time.
Here’s how I put it in the webinar: “So that would be agentic AI, where you’ve got an AI basically following a process and doing a workflow and going out and doing things on its own schedule or schedule you set.” Later, when I walked through the steps a dealership takes with AI, I said the third piece, agents, “is where it gets really interesting because that’s where it starts to function more like a program.”
That last part is the one to sit with. A program runs whether you’re watching or not. So does an agent. Nobody clicks “go.” It just goes.
| AI chat | Automated workflow | AI agent | |
|---|---|---|---|
| What starts it | A person typing a question | A fixed trigger, such as a form being submitted | A schedule or an event, then its own judgment about what to do next |
| What it touches | What the person pastes in or connects | The two or three systems it was wired to | Anything its account can reach in the DMS, CRM, email, and shared drives |
| Who sees the result | The person who asked | Whoever the workflow routes it to | Managers, customers, or other systems, depending on how it’s set up |
| Dealership example | A sales manager drafts a follow-up email | A new service lead is routed to the right advisor | Every morning, find the recon units that haven’t moved and tell the used car manager |
Agents are also showing up inside the software you already pay for. On October 13, the trade newsletter Dealership Guy reported that VINCUE launched 11 AI agents across its inventory platform, covering things like appraisal, pricing, reconditioning, and lead follow-through. Expect more vendors to follow. Some of those agents will be genuinely useful. Others may show up switched on with access nobody at the store thought about. Read the settings.
To be clear, I’m not the guy telling you to sit agents out. I use AI every day and I think everybody in this business should. Cox Automotive’s AI in Auto Retail Tracker, released August 11, 2026, found that 82% of dealers use AI today, and automating routine or complex tasks was tied for the top use at 40%. The same survey found about 1 in 3 dealers either aren’t measuring AI’s impact or have no clarity on how they’re measuring it. That’s the gap agents fall into. Lots of use. Not much ownership.
An agent is a program you didn’t write, running on access you granted. Treat it like one.
Start With the Problem, Not the Tool
At the end of the webinar, an attendee asked what a good first AI project looks like for a dealership that wants to start small. It’s the right question asked backward. “I would challenge you to reverse that question,” I told them. “What are things that are challenges for us that we can think about creating a workflow around?”
Then the practical version: “think about an area in your dealership that requires steps. And a lot of times those steps are a person going into different things to figure out the status of something.”
That sentence describes a lot of jobs in a dealership. Someone checks the DMS, then the inventory tool, then a spreadsheet, then walks out to the lot. Every day. Sometimes twice. An agent is good at exactly that kind of checking, and it doesn’t get bored on day 40.
What I’d steer you away from is the big bang. We see a lot of dealers skipping the early steps and jumping straight to building custom applications with AI, and I’ve watched for years what happens when dealers try to write their own software. We wrote up the risks of software your team builds with AI separately, because it deserves its own post. “I’m not saying don’t go big,” I said in the webinar, “but make sure you don’t miss out on those incremental steps.”
Small wins first. Boring ones. Measurable ones.
Three First Projects That Fit Most Stores
All three of these came up in the webinar. Each one reads information from places your people already check by hand, and each one ends with a person doing something.
1. Follow Used Cars Through Reconditioning
This is the client story from the top of the post. Slow recon was only the symptom. The real trouble was that nobody could see where a car was, because the status lived in several applications across several departments. I gave one honest caveat in the webinar. If your recon process runs in one system, that system probably already has alerts, and you should turn those on before you build anything. Agents earn their keep when the information is scattered.
A good recon agent reads the stock number, the repair order status, the detail queue, and the frontline-ready date, then sends the used car manager a short list every morning of the units that are stuck and where. It doesn’t move anything. It doesn’t reprice anything. It reads. It reports. That’s all.
And you can measure it. Days in recon go down or they don’t.
2. Review Inbound BDC Calls and Emails
The first agent example I gave in the webinar was a customer who wanted AI to regularly go through the telephone calls and emails coming into the BDC, look for dropped calls, missed calls, overhandled calls, and customer sentiment, and report back. No customer ever hears from it. The agent watches the process and tells a manager where it’s leaking.
The catch is what it reads. Call recordings and BDC emails are full of names, phone numbers, trade details, and sometimes credit information. So this agent needs read access to recordings and the CRM notes, nothing else, and its reports should name the problem without copying the customer’s personal details into a summary that gets forwarded around. If what you’re really shopping for is the other kind of AI BDC, the kind that answers leads on its own, my colleague Scot McConnor wrote up the questions to ask before an AI BDC works your leads, and I’d start there.
3. Read Help Desk Tickets for Unhappy Customers
Helion is in the process of developing an agent that looks into our own ticketing system for tickets with unhappy customer sentiment. It’s not done yet. I explained why we’re bothering on the webinar, and I’d say it the same way today: “I mean, that’s something we’re all keen to understand. Is a customer happy? And if they’re unhappy, can I get them quickly and turn them around? I don’t want them just walking away unhappy.”
Your service department has a pile just like our ticket queue. It’s the customer emails, the survey comments, the notes from follow-up calls. Point the same kind of agent at that, and a service manager gets a short list of people worth calling today.
When a dealer asks me whether their idea is a good first project, I end up asking the same handful of things in some order. Is somebody already checking several systems just to find out where one thing stands? Can the agent do the job with read-only access, at least at the start? Is there a manager whose name is on the output, rather than a shared inbox that nobody opens after the first week? Will a number you already watch, like days in recon or missed BDC calls, move if it works? And when it gets something wrong, which it will now and then, does any of that reach a customer? If the answer to that last one is yes, it isn’t a first project.
Who Controls the Agent: Access, Sign-Off and the Audit Trail
This is the part nobody wants to hear, and it’s the part that matters most. An agent works with whatever access it’s actually given, which isn’t always the access you meant to give it, and in a lot of dealerships the access is already a mess before any AI shows up.
You’ve seen it. I have too. An account gets copied from one employee to another, the new person inherits permissions nobody meant them to have, and now someone has elevated access. In the webinar I put the agent version of that risk in a single line: “AI exposing permissions that it already had.” I also told the story of an IT person at a client who asked us for admin rights to do “this AI thing,” and was about to launch a tool with network-wide administrative access. We wrote that one up in the governance guide. Now picture the same access handed to something that runs every night without anyone watching.
The OWASP Gen AI Security Project has a name for it. Its 2025 list of top risks for AI applications calls it excessive agency, and traces it to three causes: excessive functionality, excessive permissions, and excessive autonomy. Too many tools. Too much access. Too little checking. That’s a fair description of how a lot of agents get switched on.
So before an agent goes live, settle four things:
- the account it runs under, and exactly what that account can reach in the DMS, the CRM, and Microsoft 365;
- which actions it takes alone and which wait for a person to approve them;
- where every action it takes is logged, and who reads that log;
- and the one person at the store who answers for it.
Its Own Account, With Only the Access It Needs
An agent should never run as a person. Not as the IT manager. Not as the controller. Never as an administrator. Give it its own named account in the DMS, the CRM, and Microsoft 365, with the smallest set of permissions its job requires. The recon agent can read repair orders and inventory status. That’s it. No deal jackets, no payroll, no mailboxes.
The FTC Safeguards Rule already asks for this. It requires access controls that limit authorized users’ access only to customer information that they need to perform their duties, and an agent touching customer data is an authorized user for all practical purposes. Modern DMS platforms help here. Tekion, for example, has granular per-user access controls built in, and an agent’s account can be set up with the same care as a new employee’s. We go further into scoping in our post on least-privilege access for AI tools.
What It Does Alone, and What Needs a Person’s Sign-Off
Decide this on purpose, in writing, before launch. Which tasks get automated and which stay with your people is a governance decision, not a setting the vendor picks for you. OWASP’s advice is the same as mine: require a human to approve high-impact actions before they’re taken.
| The agent may do this alone | A person signs off first | The agent never does this |
|---|---|---|
| Read statuses, notes, and tickets it was scoped to | Change a record in the DMS or CRM | Delete records or files |
| Write a summary or a daily list | Send anything to a customer | Change its own permissions or anyone else’s |
| Alert a named manager inside the store | Reassign a lead, a car, or a repair order | Move money, approve credit, or touch payroll |
| Open an internal ticket | Change a price or a payment figure | Export customer data outside your systems |
I’d be surprised if your table looked exactly like mine, and I don’t care much where you put each line, as long as somebody at the store sat down and drew them on purpose and wrote down the moment a person takes over from the agent.
An Audit Trail You Can Actually Read
Early in my career I worked in a three-person IT department supporting about 100 actuaries, and I loaded a module onto the servers to make file storage easier. The server went down. My boss fixed it and then told me, “That worked out for us. If it hadn’t, you’d have lost your job.” I’ve thought about that a lot since agents showed up, because an agent is a change to your systems that keeps happening every night, and if you can’t see what it did, you can’t fix what it broke.
So the agent’s account gets logged like any employee’s, and probably more closely. The Safeguards Rule already asks dealers to monitor and log the activity of authorized users and to detect unauthorized access, and I’d want that log to show what the agent read, what it flagged, anything it changed, and who approved the change, in a form your own manager can read on a Saturday without calling anyone. If a vendor’s built-in agent can’t show you that, ask them why not, and keep asking.
One Named Owner in the Business
Who owns that? It’s the question I ask about every piece of software a dealer brings in, and agents make it louder, because an agent with no owner keeps running long after everyone forgets it’s there. In practice, the person who owns the process owns the agent, so the used car manager answers for the recon agent and the BDC manager answers for the one reviewing calls. IT owns the account and its access. Above both, someone approves new agents before they go live, and at a single-point store that can simply be the dealer principal and the controller.
Brandon Dorsey, Helion’s Vice President of Technology Strategy, makes a point I’d add here. Buying the AI platform is only the first step. Dealers buy licenses and start a pile of AI initiatives with no plan, no integrations, and no defined goals, and handing an enterprise license to staff with no rollout plan adds risk of its own when nobody sets the access controls, builds the workflows, or secures the data connections. His fix is to decide what an agent may reach, and who builds and secures its workflow, before it’s switched on.
No owner, no agent.
How We Approach Agents at Helion
We’ve already seen this exact problem across our client base. Helion Technologies has supported 2,000-plus dealerships and 35,000 end users over nearly 30 years, and the permission mess that agents inherit is the same mess we clean up in networks, mailboxes, and DMS user lists.
So our Managed AI service starts with the boring part. We set up a governed corporate AI platform with role-based access managed by our team, connect it to your data sources one at a time, and keep an audit trail of prompts and responses. Any agent built on it should follow the rules in this post: its own account, scoped access, and a named owner at the store. When an agent needs DMS data, we follow the same approach we laid out for connecting generative AI to your DMS: read-only first, only the fields it needs, nothing exported to a desktop.
We’re one integrated team, so the people who manage your network and security are the same people scoping the agent. When something breaks, there’s no finger-pointing between an AI vendor and an IT vendor. One call. One answer.
That’s the whole point of doing it this way.
Things Dealers Ask Me About AI Agents
Agentic AI vs a chatbot: does the gap actually matter?
Our DMS or inventory vendor is adding agents. Do we still need our own rules?
Can one agent cover all our rooftops?
Who should sign off before an agent goes live?
We’re one store with one IT person. Is this too early for us?
Pick the Problem First
We’ve had clients hand us a ten-page list generated by an AI tool, and you can tell right away nobody on their side actually thought it through. A first agent is the opposite of that list. It’s one job, the one where somebody at your store spends part of every morning checking four systems to answer a single question, and it comes with its own account, the least access it needs, a short list of things it never does alone, and a manager whose name is on it.
Our complimentary IT and cybersecurity assessment is a decent way to find that job, and to see what your systems would hand an agent if you switched one on tomorrow. We’ll go through your access, your permissions, and your data connections with you before anything gets switched on. Get those right and the agent is the easy part.