AI Agents Can Act for You — But What Should You Let Them Do?
AI assistants used to be relatively easy to understand. You asked a question, and they gave you an answer. You might then use that answer to write something, make a decision or complete a task yourself.
AI agents change that relationship. Instead of simply suggesting what you could do next, an agent may be able to open files, search the web, interact with software, send messages, update records or carry out a sequence of tasks on your behalf.
That can save a lot of time, particularly when the work involves repetitive steps across several systems. However, it also raises a much more important question than “What can this AI do?”
What should you actually allow it to do?
From answers to actions
The difference between an ordinary AI assistant and an AI agent is not always clear-cut, but there is one useful distinction. A chatbot usually gives you information or produces something for you to review. An agent can potentially take action based on its instructions, the information it can access and the tools connected to it.
For example, an AI assistant might draft an email for you. An AI agent could potentially draft the email, open your email account, find the recipient and send it without requiring you to complete each step manually.
Those two situations may sound similar, but the risk is very different. If a chatbot produces a poor email, you can spot the problem before anything happens. If an autonomous agent sends that email immediately, the mistake has already left the building. You may then need to correct the message, explain what happened or deal with damage to the customer relationship.
That leads to a simple principle:
A chatbot can give you a bad answer. An agent with permissions can take a bad action.
The distinction matters because an agent’s usefulness depends not only on the quality of its reasoning. It also depends on the systems it can access, the actions it is allowed to perform and the safeguards that exist when it misunderstands a request.
Why this matters now
Agentic AI is moving quickly from research into everyday software. OpenAI, Google, Microsoft, Anthropic and other technology companies are developing systems that can work across applications, use tools and complete increasingly complex tasks.
That makes AI potentially much more useful to businesses. An agent could help organise information, prepare customer communications, update internal systems or coordinate a workflow that would otherwise require several manual steps.
However, greater capability also increases the importance of access controls. The more systems an agent can use, the more opportunities there are for an incorrect instruction, a misunderstood objective or an unexpected result to create a problem.
Recent reports show why these boundaries matter. OpenAI’s August report describes a July 2026 evaluation incident involving unauthorised access to Hugging Face systems. Its September update also acknowledges agents using a public wiki as a message board.
In a 9 September assessment, Anthropic described four evaluation incidents involving access to real third-party systems. These reports concern research and testing environments with reduced safeguards, rather than typical small-business deployments.
The lesson is broader than a simple misunderstanding. Anthropic’s later assessment identified biased reasoning and a willingness to take harmful actions while pursuing a task. Whatever the cause, an agent’s access can turn a failure into real-world harm. If it can read sensitive information, change records or communicate externally, the consequences can extend beyond the original task.
The UK National Cyber Security Centre has also been warning organisations to think carefully before adopting highly autonomous AI systems. Its advice includes limiting what agents can access, applying the principle of least privilege, maintaining visibility over their actions and keeping humans accountable for how they are deployed.
For small businesses, that does not mean avoiding AI agents. It means using them deliberately, starting with tasks where the benefits are clear and the consequences of mistakes are manageable.
Start with the lowest level of authority you need
Not every AI task requires full autonomy. In many cases, a business can gain substantial value from an agent that analyses information or prepares work without being allowed to make final changes.
It can be helpful to think about three broad levels of authority. These are a practical way to organise your decisions, rather than an official security standard.
Level 1: Read and suggest
At the first level, the agent can analyse information but cannot make changes. It might summarise documents, analyse a spreadsheet, search your knowledge base, identify important emails or suggest a reply.
A human still decides what happens next. This arrangement is often suitable when the information is useful but the final decision requires context, judgement or accountability.
For some businesses, this may deliver much of the benefit while reducing the risk of unwanted changes. Read-only access still carries privacy and confidentiality risks, and recommendations can still be wrong. The agent can reduce the time spent searching, sorting and preparing information, while the business retains control over every external action.
Level 2: Prepare, but ask before acting
At the second level, the agent can do more of the work, but certain actions still require approval. It might prepare an email and ask you before sending it, create a proposed calendar appointment, draft a customer record or prepare changes to a document.
This is often a useful middle ground because the AI handles the repetitive parts of the process while a person remains involved at the point where the action has real consequences.
Approval does not necessarily have to mean reviewing every minor step. You could allow an agent to organise internal notes automatically while requiring approval before it contacts a customer, changes a financial record or publishes anything publicly.
Level 3: Act autonomously
At the highest level, an agent can complete actions without asking for approval each time. Depending on how it is configured, that might include sending messages, changing customer records, publishing content, making purchases, issuing refunds or modifying live systems.
There are situations where this can make sense. For example, a low-risk internal process with clear rules and easy recovery may be suitable for automation.
However, the more authority you give an agent, the more carefully you need to think about what happens when it gets something wrong. You should consider whether the action can be reversed, whether anyone will notice the mistake quickly and whether the agent could affect customers, finances, confidential information or your reputation.
Mercia AI’s AI Quick Wins for Small Businesses provides a broader starting point for choosing useful business tasks.
Five questions to ask before giving an AI agent access
Before connecting an AI agent to a real business system, ask five practical questions. The answers should help you decide whether the agent needs access at all and, if it does, how much authority it should receive.
What can it see?
Does the task really require access to your entire inbox, customer database or shared drive? In most cases, it should not. Give the agent access only to the information it genuinely needs for the task.
Set those limits in the connected system’s permissions wherever possible. An instruction saying “do not delete files” is not the same as removing delete access. Content the agent reads can also contain malicious instructions designed to redirect it, known as prompt injection.
This reduces the amount of sensitive information that could be exposed if the agent makes a mistake or if the connected system is compromised. It also makes the agent’s behaviour easier to understand because it is working within a clearly defined information boundary.
What can it change?
Reading a customer record and deleting one are very different permissions. Similarly, preparing a change to an order is not the same as confirming that change in your live system.
Where possible, separate the ability to view information from the ability to modify it. If changes are necessary, consider whether the agent should be allowed to create new records, edit existing ones or delete information. These permissions should not automatically be treated as equivalent.
What can it send or publish?
Anything that leaves your organisation deserves particular attention. Emails, social media posts, customer communications and financial transactions can all create consequences that are difficult to reverse.
An agent may produce a message that sounds plausible but contains an incorrect price, an inappropriate promise or confidential information. Requiring approval before external communication is often a sensible safeguard, especially while you are still learning how reliably the system behaves.
Which actions require human approval?
You do not need to choose between “AI does nothing” and “AI controls everything”. Human approval points can sit between the two.
The right approval points will depend on the task. You might allow an agent to prepare routine internal work without approval, while requiring a person to approve anything involving money, legal commitments, sensitive data, customer complaints or public communications.
Can you see what it did and undo it?
Logs, activity histories and reversible actions matter. If an agent changes something, you should ideally be able to understand what happened, which information it used, who authorised it and whether the change can be reversed.
A system that cannot show what the agent did is difficult to manage responsibly. Before relying on an agent, check whether you can review its activity and whether there is a practical recovery process if it makes an unwanted change.
Good AI governance does not have to be complicated
Words such as governance, permissions and risk management can make AI adoption sound like something only large companies can handle. It does not need to be complicated or expensive.
For a small organisation, sensible AI governance might simply mean starting with one clearly defined task and documenting what the agent is expected to do. Give the AI only the information and permissions needed for that task, rather than connecting it to every system at once.
You can then require approval for higher-risk actions, review what the system actually does and expand its responsibilities only when you are comfortable with the results. If the agent behaves unexpectedly, pause the automation, investigate the cause and adjust its instructions or permissions before allowing it to continue.
That is not unnecessary bureaucracy. It is the same principle businesses already use when deciding which employees, contractors or software systems should have access to sensitive information.
After decades working with software systems, I have learned that capability is only half the question. Permissions matter just as much. A system may be capable of performing a task, but that does not mean it should be allowed to perform every related task without supervision.
AI should earn autonomy
There will probably be businesses where highly autonomous AI agents become genuinely valuable. They may eventually handle complex workflows that currently require several people and multiple software systems.
However, autonomy should not be the starting point. An agent that reliably analyses information and prepares recommendations may already save significant time. If that works well, you can gradually allow it to do more, measuring the results at each stage.
The aim is not to give AI as much control as possible. It is to give it enough control to be useful, while keeping the consequences of mistakes manageable.
That balance will be different for every organisation. A marketing agency may be comfortable automating some internal content processes, while a financial services business may require approval for almost every external action.
Increasingly, deciding where that boundary sits may be one of the most important parts of adopting AI responsibly. The businesses that benefit most from AI agents are unlikely to be those that give them unlimited access immediately. They are more likely to be the ones that introduce autonomy gradually, monitor the results and make sure a human remains accountable for important decisions.
Thinking about introducing AI or automation into your business?
Before connecting AI to your data, workflows or business systems, it is worth understanding where it can genuinely help, what access it needs and where human oversight should remain.
Mercia AI’s AI Readiness Consultation helps small organisations assess practical AI opportunities, risks and next steps before committing to new tools or automation.
Book an AI Readiness Consultation — £120 for 90 minutes online. Please book at least 48 hours ahead.
