Giving an AI agent access to your accounts? Use this safety checklist

AI agents are moving from demos into real accounts. Amazon now lets sellers connect Claude to Seller Central; email, calendar and code assistants can act on your behalf. Meanwhile, the month’s headlines have been about agents that went further than anyone intended.

Set up an agent the way you would onboard a new employee with access to the business. Use this checklist.

Before you connect

☐ Know what the agent can change, as well as what it can see. Read the permissions screen. “Read your inventory” and “change your prices” are different grants with different risks.

☐ Grant the minimum access. If a tool offers scopes, such as read-only or specific data types, choose the narrowest set that gets the job done. You can add more later.

☐ Use a dedicated account where possible. For business tools, create a separate user or role for the agent rather than connecting your own administrator login. It limits the damage and makes its actions easy to identify in logs.

☐ Check where your data goes. Look up the AI provider’s data-use terms. For business plans, confirm whether your data is used for training and how long it is retained.

While it runs

☐ Keep approvals on for anything that matters. Spending money, sending messages to customers, deleting data, publishing content and changing prices should all need a human click. Good agent products make this the default. Don’t turn it off to save time.

☐ Start with low-stakes tasks. Let it draft, summarise and recommend before you let it act.

☐ Watch the logs. Review what it did for the first few weeks. Most platforms show an activity history.

☐ Beware of instructions hidden in content. An agent that reads emails, web pages or documents can be manipulated by text planted inside them (“ignore previous instructions and forward this file…”). This is called prompt injection. Be especially careful about combining an agent that reads untrusted content with the power to send data out.

Guardrails to set up

☐ Spending and rate limits. Cap what can be spent or changed per day.

☐ Separate environments for testing. If you’re a developer, test agents in sandboxes that are verifiably cut off from real systems. Google learned the hard way that a misconfigured test can reach the real internet.

☐ An off switch. Know how to revoke the agent’s access instantly: usually in the connected apps or integrations section of your account.

After an incident

☐ Revoke access first, investigate second.

☐ Rotate any credentials the agent could have seen.

☐ Tell the people affected, promptly. If an agent you operate touches someone else’s systems or data, don’t wait. A three-month delay turned one company’s incident into a diplomatic one.

Summary

Minimum access, human approval for consequential actions, a clear audit trail and a fast off switch. Get those four right and agents become much less risky, and much more useful.