How to secure an AI agent for business use.
Security starts with a commercial question: if the agent gets this wrong, what money, data, customer trust or operating time could the business lose?
Risk follows access and consequence.
Do not rate an agent as simply safe or unsafe. Rate every tool and action it can use.
What can it see?
Email, files, customer records, financial information, credentials and external web content can all change the risk.
What can it change?
Drafting a new document is different from altering the source-of-truth CRM, ledger, policy or production database.
Who can it contact?
Internal notes are lower consequence than messages, bookings or promises sent to customers, staff and suppliers.
Can it commit money?
Purchases, refunds, ad budgets, credits and contract terms need explicit limits and normally human approval.
Can it remove or overwrite?
Deletion and irreversible changes require backups, narrow permissions and an approval path outside the agent.
How far can one mistake travel?
Volume, scheduling and access across tools can turn a small error into hundreds of actions before a person notices.
Increase autonomy only after controlled testing.
Autonomy should match evidence, not excitement. Different actions inside the same workflow can sit on different levels.
Read and recommend
The agent gathers approved information and proposes an answer. A person performs every external or record-changing action.
Draft and stage
The agent prepares replies, updates or transactions in a review queue. Nothing sends, publishes, pays or commits until approved.
Act within narrow rules
It completes low-risk, reversible actions inside clear limits and pauses on exceptions, uncertainty or protected categories.
Run bounded low-risk work
Proven workflows can run on a schedule with monitoring, action limits and a tested stop. High-stakes actions remain gated.
Protect the business without making the system unusable.
Give only the access this job needs
Use a dedicated account or role, narrow folders and named tools. Separate read access from write access. Remove permissions when the workflow changes.
Decide what instructions are allowed to count
External emails, websites and documents may contain malicious or misleading instructions. Treat them as data, not authority, and restrict actions after reading untrusted content.
Gate consequences, not every click
Require approval before money, deletion, publishing, legal commitments, customer promises, sensitive-data changes or actions outside the normal pattern.
Prefer actions you can undo
Stage a message, create a new record and use soft deletion where possible. Back up source data and test restoration.
Know what happened and why
Record the request, source, tool, action, result, approval and error. Alert on unusual volume, repeated failures, blocked access and high-risk attempts.
Keep a manual path alive
Define who can pause schedules, revoke tokens, disable integrations and return the work to people. Test it before the first incident.
Write the boundary down before connecting the tool.
| Tool or system | Read | Write/action | Approval required | Limits and logs |
|---|---|---|---|---|
| [Support inbox] | [Named folders only] | [Draft; never send] | [All external replies] | [Log source and draft] |
| [CRM] | [Contacts and open deals] | [Add note; no deletion] | [Owner or value changes] | [50 records/run; audit log] |
| [Accounting] | [Invoice status only] | [None] | [Every financial action] | [No bank details; read log] |
| [Website CMS] | [Draft content] | [Create draft] | [Publish, plugins, users] | [Version history; staging first] |
| [Add your tool] | [Minimum needed] | [Exact allowed action] | [Named person/threshold] | [Rate, spend, time and log limits] |
Also record who owns the agent, how credentials are stored, when access is reviewed and how it is revoked.
A constrained agent can still complete useful work.
Draft routine replies; escalate exceptions
Read the customer message, order status and approved policy. Draft only. Complaints, refunds, safety issues and unclear identity go to a person.
Prepare the next step without inventing a promise
Read the enquiry and approved offer. Draft or stage a response. Pricing changes, unusual scope and sensitive details require approval.
Read broadly, write narrowly
Pull approved metrics, create a new report and cite each source. No changes to the underlying records. Flag missing or inconsistent numbers.
Separate information from financial authority
Read invoice status and draft reminders. Do not change bank details, issue credits or send unusual payment instructions without a person.
Stage changes before the public sees them
Create a draft or staging version, run checks and show the difference. Publishing, account permissions and production integrations stay gated.
Prove the controls with real work.
- Name the owner and outcome. One person remains accountable for the system and the work it affects.
- Map data and tools. Record what enters, where it goes, who can access it and which third parties are involved.
- Classify each action. Rate consequence, reversibility, sensitivity, volume and whether untrusted content can influence it.
- Set the permission matrix. Start at read or draft; add only the narrow actions needed for the pilot.
- Build test cases. Include normal work, missing information, malicious instructions, unusual volume and unavailable tools.
- Test approvals and failure. Confirm the agent pauses, the right person is reachable and the fallback works.
- Monitor a small launch. Review every output first, then sample only after quality and controls hold up.
- Review access regularly. Remove unused tools, rotate credentials and revisit the boundary after any workflow or supplier change.
When something looks wrong, stop first and diagnose second.
- Pause: disable schedules and the agent's action access. Use a separate administrator account if the agent's own environment may be affected.
- Preserve: keep logs, prompts, tool calls, approvals, timestamps and affected outputs. Do not destroy evidence while cleaning up.
- Contain: revoke tokens, rotate exposed credentials, isolate affected integrations and block the harmful action path.
- Assess: identify data accessed, records changed, messages sent, money affected and people who may be harmed.
- Escalate: contact your security, privacy, legal, insurer, provider or regulator as the situation requires. Reporting obligations vary.
- Recover: restore trusted data and the manual workflow. Re-enable only after the cause and control gap are understood.
- Learn: document the incident, update tests and permissions, and decide whether the system should return at a lower autonomy level.
Keep the stop mechanism outside the agent
The person responding must be able to revoke access even when the workflow, connected account or agent session is behaving unexpectedly.
Personal information changes the decision.
The OAIC advises Australian organisations to conduct due diligence on commercial AI products, embed human oversight and understand who can access personal information in inputs and outputs. As a matter of best practice, it recommends not entering personal—especially sensitive—information into publicly available generative AI tools.
Before connecting customer, staff or supplier data, establish the lawful purpose, data minimisation, retention, supplier terms, transparency, accuracy checks and a person who can override the result. Get appropriate advice for your circumstances.
Questions before granting access.
No. People can approve too quickly or misunderstand the action. Combine approvals with least privilege, clear summaries, limits, logs, testing and technical safeguards.
Not necessarily. Gate sensitive, unusual, high-value and irreversible actions. Excessive prompts create approval fatigue and can weaken attention.
Web content is untrusted and may contain prompt injection or false information. Restrict destinations, separate reading from consequential actions and require source verification.
After representative testing and monitored real use show acceptable quality, stable exceptions and effective controls. Increase one permission at a time and keep a rollback path.
Build the useful system and the boundary together.
Current guidance behind the controls.
- ASD's ACSC — Artificial intelligence for small business
- ASD's ACSC — Annual Cyber Threat Report 2024–2025
- OAIC — Privacy and commercially available AI products
- NIST — AI Risk Management Framework Core
- OpenAI — A practical guide to building AI agents
- Anthropic — Use Claude Cowork safely
This is general educational guidance, not legal, privacy or cyber-security advice. Controls should match your systems, industry, data and consequences.