Security basics for AI agents in a small business

An AI agent that can read email, search documents and update your CRM is useful — and it needs the same care as giving a new employee access to those systems.

Give the minimum access

Each integration should have its own credentials with the narrowest permissions possible. If an agent only needs to create CRM notes, it should not be able to delete contacts.

Treat outside content as untrusted

Emails, uploaded documents and web pages can contain text designed to manipulate an AI ('ignore your instructions and…'). This is called prompt injection. Agents should treat such content as data, never as instructions, and should not be able to take consequential actions based only on it.

Require approval for consequential actions

• Sending messages to customers outside approved templates
• Changing or deleting business records
• Issuing refunds, credits or payments
• Anything legal, medical or financial in nature

Log, but don't over-collect

Keep logs of what the agent did and why, so you can investigate problems. Avoid storing full customer messages or documents in logs unless you need them, and apply a retention period.

Keep keys on the server

API keys for AI providers and business tools belong in a secure server-side store, not in browser code, spreadsheets or shared documents. Set usage limits with your AI provider so a bug can't create an unlimited bill.

If a vendor can't explain what their agent is allowed to do, what it can't do, and who approves what — don't connect it to your systems yet.