Give AI only the tools it needs: a guide for owners

Give it the smallest set of permissions that lets it finish one job. If the AI drafts replies to enquiries, it needs to read new emails and write drafts. It does not need your sent folder, your bank or the power to delete anything. Start there and add only when a real need appears.

This is the same rule security people apply to any new staff member or software. OWASP, the security community that tracks risks in AI apps, calls the danger excessive agency: an AI with more functions, more permissions or more freedom than its job requires, able to do real damage when it gets something wrong.

Read before write

Reading is low risk. Writing changes things. Most jobs can start read-only: summarise the inbox, list the unpaid invoices, flag the bookings with missing details. Add write access only for the one thing that has to change. OWASP gives the same example: an AI that summarises email needs to read mail, not send it.

Drafts before sends

An AI that writes a draft for you to send costs you a click. An AI that sends on its own can put a wrong price in front of a customer at two in the morning. Keep it on drafts until weeks of drafts have needed no changes.

One job, one set of keys

Don't give one AI everything because it might be handy later. The café's social posting assistant needs your photo folder and your social accounts. It has no reason to see the till or the staff rota.

Its own login, so you can switch it off

Where the tool allows it, connect the AI with its own account or a delegate setting, never your personal password. Then you can see what it did, and remove its access in one place without changing anything else.

Why even a well-behaved AI needs limits

An AI that reads your inbox also reads whatever strangers send to it, and a cleverly worded email can try to give it orders. The UK's National Cyber Security Centre says this kind of attack, called prompt injection, may never be fully fixed, and advises against giving an AI that reads outside emails access to powerful tools. Its post prompt injection is not SQL injection explains why. Limits are what keep a tricked AI harmless.

Some access is never worth the risk for a small business, however good the tool. These stay with you, or sit behind a step where a person has to say yes. Which decisions should always keep a person in the loop is covered in which AI jobs still need a person to sign off.

Your main passwords

Never paste a password into a chat or a message, to an AI or to anyone setting one up for you. Access should be shared the safe way, through each tool's own team or delegate settings.

Admin accounts

An admin account can change settings and control everything else. The NCSC advises using an everyday account for normal work and keeping admin access for when it is genuinely needed, in its guide to securing your important online accounts. An AI never needs to be an admin to do one job.

The power to move money

Paying, refunding and transferring stay with a person, or behind a hard limit you set. A bookkeeper's AI can prepare the payment run. You press the button.

The power to delete

Deleting is the one action you can't take back. An AI that tidies files or emails should move things to a folder for you to check, never remove them for good.

The right to change its own rules

The AI should never be able to widen its own access or edit the limits you set. Only you change the rules, and only after looking at what the job needs. OWASP calls this complete mediation: the system the AI connects to decides what is allowed, not the AI.

The risk is rarely the AI itself. It is a connection that hands over more than the job needs, often without the owner noticing. Four to look out for.

Full mailbox access for a drafting job

Some ways of sharing an inbox are all or nothing. Gmail's delegate access, for example, lets a delegate read, send and delete email for you, as Google's page on delegating your Gmail sets out. That suits a trusted assistant. It is far more than an AI drafting replies needs, so look for a draft-only connection instead.

The Allow all screen

When you connect an AI tool to another service, the permission screen lists what it is asking for. The official security guidance for the Model Context Protocol, the standard many AI tools use to connect to other apps, warns against asking for every permission up front and recommends starting with low-risk read access, in its security best practices. If a tool asks for everything to do one small job, ask why.

One shared login for everyone

If the AI uses the same login as you and two staff, you can't tell who did what, and you can't switch the AI off without locking everyone out. Give it its own account.

Connections nobody remembers

The trial tool from last spring may still be able to read your inbox. Check each service's list of connected apps and remove the ones you no longer use.

With tight limits, a mistake stays the size of one job: a bad draft you delete. With wide access, the same mistake can reach every customer, every file and your bank. The limits decide how bad your worst day with AI can be, not the model.

A worked example: a physio clinic

A three-room physio clinic uses AI to send appointment reminders. With tight limits, it reads tomorrow's diary and sends one fixed reminder text. If it gets confused, the worst case is a wrong reminder that a patient queries. With wide access to the diary and the patient notes, the same confusion could cancel a morning of appointments or send someone's notes to the wrong person.

Example figures: what a bad day costs

Made-up but realistic: a cancelled morning of six appointments at £45 each is £270 lost, plus the phone calls to rebook. A wrong reminder costs one apology. Same AI, same mistake. The only difference is what it was allowed to touch.

Why limits cost you almost nothing

For most jobs, the right limits take an afternoon to set and don't slow the AI down at all, because it never needed the extra access. You lose only the things it shouldn't have been doing anyway.

If the AI can see customers' personal data, limiting its access is also part of your legal duty, not just good sense. Two principles cover it.

Keep personal data secure

UK GDPR asks for appropriate technical and organisational measures to keep personal data safe, including access controls so that only authorised people and systems can view, change or delete it. The ICO's guide to data security sets it out. An AI with access to everything is hard to square with that.

Use no more than the job needs

Data minimisation means using personal data that is adequate, relevant and limited to what the purpose needs, as the ICO explains under data minimisation. A reminder bot needs a name, a time and a phone number. It does not need the notes. Our GDPR Compliance Kit writes the data map that shows who and what can see each kind of data.