AI Agent Permissions Checklist: Give Business Bots Only the Access They Need

Why agent access is the security story this month

On 19 October 2026, Microsoft's security blog published a post with a blunt title: agents are your newest insiders. The argument is simple. To be useful, AI agents need access to company data, apps and tools, and that access is exactly what makes them a risk. They can make mistakes, be manipulated or be compromised, and they can work continuously at machine speed.

Two days later, CBS News asked security experts whether people should trust personal AI agents with their money and data. One consumer education expert said she would happily let an agent compare deals but would not let it use her credit card. A media and technology lawyer added that giving an agent your card details makes it an authorised user, so if it overspends, the card issuer may argue you approved the purchase.

Neither story is really about clever models. Both are about permissions. For a small business that is good news, because permissions are something you can fix this week without a security team.

The real risk is access, not intelligence

The OWASP GenAI Security Project lists "Excessive Agency" as one of its top risks for applications built on large language models. It names three root causes, and they map neatly onto small-business automations:

• Excessive functionality: the agent can call tools it does not need. OWASP's example is a connector meant to read documents that can also edit and delete them.
• Excessive permissions: the agent's account can do more than its job requires, such as a database login that can update and delete when the agent only needs to look things up.
• Excessive autonomy: high-impact actions happen without anyone checking, such as deleting records or sending money without confirmation.

A wrong answer from a bot is embarrassing. A wrong answer from a bot that can also issue refunds, export your contact list or message every customer is an incident. The difference is the access you gave it.

What counts as an AI agent in a small business

You probably have more agents than you think. Count anything that reads information and then takes an action without a person pressing the button each time:

• A WhatsApp or website chat bot that answers enquiries and creates leads.
• An AI lead qualifier that scores enquiries and writes notes into your CRM.
• An inbox assistant that drafts or sends email replies.
• An invoice or payment-reminder flow that uses AI to word its follow-ups.
• A booking agent that reads calendars and confirms appointments.
• Any no-code workflow where an AI step decides which branch runs next.

Step 1: Build an agent access register

Start with a single sheet. One row per agent, with these columns: the agent's name, the person who owns it, what it is for, which systems it connects to, which account or API key it uses, what it can do in each system, any spending or sending limit, and the date someone last reviewed it.

This sounds like paperwork, but it is the step most teams skip. A Tech Critter explainer on non-human identities published on 24 October 2026 describes the usual mess: service accounts created for a temporary job that stay active for years, and API keys that keep working after the person who created them has moved on. If nobody owns an agent's access, nobody will ever reduce it.

Step 2: Give every agent its own identity

Never connect an agent with the owner's personal login or a shared admin account. Create a separate user, role or API key for each agent and name it clearly, for example "lead-bot-crm-key". Then three good things happen: you can see in the logs which actions came from the bot, you can switch off one agent without breaking the others, and a leaked key exposes one small job rather than the whole business.

If a tool only offers a single all-powerful API key, write that in the register. That is a reason to put a tighter workflow tool in between, or to choose a different tool for that job.

Step 3: Split read, draft, write and act

Think of access as four levels, and give each agent the lowest level that still does the job:

• Read: look up an order status, a price list or a calendar.
• Draft: prepare a reply, quote or note for a person to approve.
• Write: create or update a record, such as adding a new lead or a tag.
• Act: send messages to customers, move money, issue refunds, delete or export data.

Most new agents should start at read and draft. Promote an agent to write only for the exact objects it needs (create leads, but not delete them), and keep act-level permissions behind a human approval until the agent has a clean track record. Our human approval matrix for AI automation shows how to decide which actions need a person: https://automasteri.com/blog/human-approval-matrix-ai-automation/ .

Step 4: Put hard limits outside the model

A line in the prompt such as "never spend more than 2,000 rupees" or "never offer a discount" is an instruction, not a control. CBS News described how prompt injection works: an attacker plants instructions in a web page, email or document the agent reads, and the agent may follow them instead of yours.

Microsoft's post makes the same point at a larger scale, quoting Satya Nadella: the controls that decide what an agent can access and do must sit outside the model, where it cannot bypass them. For a small business, that means limits enforced by the systems themselves:

• A separate payment card or wallet with a low limit, never the main company card.
• Daily caps on how many messages a bot can send.
• Allowed-recipient lists for any agent that sends email or files.
• Discount and refund ceilings set in your billing tool, not in the prompt.
• Read-only exports, or no export permission at all.

Step 5: Treat everything an agent reads as untrusted

Customer messages, inbound email, uploaded PDFs and web pages are all places where someone can hide instructions. The practical rule is separation: an agent that reads outside content should not also hold powerful permissions. The bot that reads customer emails should not be the same agent that can approve refunds or download your full contact list. If one task needs both, put a human or a fixed rule between the reading step and the acting step.

Step 6: Log what agents do and review monthly

A permission list tells you what an agent could do. Logs tell you what it actually did. For each agent, make sure you can see which identity acted, which tool or system it used, which record it touched and whether the action succeeded or was blocked. Our exception monitoring checklist covers how to get alerts when something fails: https://automasteri.com/blog/automation-exception-monitoring-checklist-small-business/ .

Then book a 20-minute review once a month. Walk down the register and ask four questions: is this agent still used, is its owner still with us, does it still need every permission it has, and have any new connectors been added? OWASP specifically warns about tools that were trialled during setup and never removed. Remove them. If someone has left, follow the automation offboarding checklist so their keys and connected accounts do not quietly keep working: https://automasteri.com/blog/automation-offboarding-checklist-employee-leaves/ .

Step 7: Be able to cut access in one move

When an agent misbehaves, you should be able to revoke its key or disable its account in under a minute, without touching anything else. Separate identities from Step 2 make this possible. Write down who can do it and where, and test it once. The AI automation kill switch guide walks through stopping a bad bot and recovering the customers it already messaged: https://automasteri.com/blog/ai-automation-kill-switch-customer-incident-recovery/ .

A worked example: the WhatsApp lead bot

Take a common setup: a WhatsApp bot answers enquiries, qualifies the lead and passes it to sales. A typical first version is connected with the owner's CRM admin login and the company's main messaging account, so in theory it can read every customer, edit any deal, delete contacts and message anyone.

A safer version of the same bot looks like this. It reads only the product FAQ and price list. In the CRM it uses its own key that can create leads and add notes and tags, with no permission to delete or export. It can share a booking link but cannot change the calendar. It has no authority to offer discounts or refunds; those questions go to a named person. Its daily message volume is capped, and every action is logged under its own name.

The customer experience is the same. The worst day is far smaller.

AI agent permissions checklist

• Every agent is listed in an access register with a named owner and a purpose.
• Each agent has its own account or API key; none uses a personal or shared admin login.
• Access starts at read and draft; write access covers only the objects the job needs.
• Sending, payments, refunds, deletes and exports need a human approval or a hard limit.
• Spending, sending and discount limits are enforced by the tools, not by the prompt.
• Agents that read outside content do not also hold powerful permissions.
• Every agent action is logged under the agent's own identity.
• Unused connectors and tools are removed after setup and at each review.
• Keys are rotated or revoked when an owner leaves or a tool is retired.
• You can revoke one agent's access in under a minute, and you have tested it.

Where to go next

If you want a second view of which of your automations hold more access than they need, the AutoMasteri free automation audit is a sensible first step: https://automasteri.com/free-automation-audit/ . AutoMasteri is a mentorship programme that helps owners design and run better systems; hands-on technical delivery is only included where the programme terms or a separate proposal say so.

Sources

Microsoft Security Blog: Agents are your newest insiders. Security must move at their speed. (19 October 2026) https://www.microsoft.com/en-us/security/blog/2026/10/19/agents-are-your-newest-insiders-security-must-move-at-their-speed/

CBS News: Should you trust personal AI agents with your money and data? Here's what experts say. (21 October 2026) https://www.cbsnews.com/news/personal-ai-agents-trust-security-risks/

OWASP GenAI Security Project: LLM06:2025 Excessive Agency https://genai.owasp.org/llmrisk/llm062025-excessive-agency/

Tech Critter: Securing Non-Human Identities in the Age of AI Agents: Risks and Best Practices (24 October 2026) https://www.tech-critter.com/securing-non-human-identities-in-the-age-of-ai-agents-risks-and-best-practices/