You're about to give an AI agent the login to your inbox, your calendar, or your customer list — and you have no real IT department to ask whether that's a good idea. Here are four plain-English questions to ask before you connect anything, so you know exactly what you've handed over and what it can do with it.
AI agent security for a small business comes down to four checks: does it only have access to what its specific job needs, can you see a log of what it actually did, does it need your okay before it does anything involving money or a customer, and can you undo it if it gets something wrong. Most of the real risk with AI agents doesn't come from the AI being "hacked" in some dramatic sense — it comes from an agent being handed broader access than its task required, and then doing something inside that access nobody meant for it to do. Ask a vendor these four questions before you connect anything, not after.
If you run a five- or ten-person business, you probably don't have a security team, and you're not going to hire one just to vet an AI tool. That's a normal, reasonable position — but it also means the questions a security team would normally ask never get asked, and the tool gets connected to your email or your booking system the same way you'd install any other app: click "allow," move on with your day. Most of the time that's fine. Occasionally it isn't, and the difference usually isn't bad luck — it's whether anyone checked what the agent could actually do before it started doing it.
The stakes are not hypothetical. IBM's 2024 Cost of a Data Breach Report put the global average cost of a data breach at $4.88 million, the highest figure in the report's 19-year history.1 That number covers businesses of every size, not small businesses specifically, so treat it as directional rather than a number your business would actually see — but small businesses typically absorb a proportionally bigger hit, since they don't have a dedicated team to contain a problem quickly or an incident-response budget to fall back on. A single mishandled customer list or an agent that sends the wrong email to the wrong list can cost a small business real customers, even if it never makes the news.
You don't need to understand how the AI model works to ask these. You need to know what to ask a vendor, or your automation partner, before you say yes.
This is called giving the agent a permission scope — put simply, a list of exactly what it's allowed to touch, and nothing beyond that. An agent that answers appointment-scheduling texts needs access to your calendar and maybe your customer contact list. It does not need access to your accounting software, your full email archive, or the ability to delete records. Connecting everything because it's faster to set up is the single most common security mistake small businesses make with these tools, and it's also the easiest one to avoid.
OWASP — a nonprofit that publishes widely used security guidelines for software, including a dedicated Top 10 list for AI applications — calls this failure mode "excessive agency": giving an AI system more permissions, autonomy, or built-in capability than the task in front of it actually requires.2 Their guidance applies to enterprise software teams building their own AI systems, but the underlying principle is exactly as relevant to a small business picking a vendor: ask what the agent can touch, and if the answer is "basically everything," that's the problem, not a feature.
If an agent sends a text, books an appointment, or updates a record, there should be a record of that action somewhere you can look at it — who (or what) did it, when, and what changed. Without this, you're trusting the system entirely on faith. With it, you can spot-check its work in five minutes a week and catch a pattern before it becomes a real problem, the same way you'd glance over a new employee's work in their first month.
For anything that involves spending money, changing a price, or sending a message a customer will actually see, the safest setup is one where the agent drafts the action and a person approves it before it goes out — at least for the first several weeks. This is the same "human in the loop" principle that applies to AI agents generally, not just the security side of them, and it's the single biggest lever you have for catching a mistake before a customer ever sees it.
Ask directly: if the agent double-books an appointment, sends an incorrect quote, or misfiles a record, what does fixing that actually look like? A good setup has a straightforward undo path. A bad one requires digging through raw data or contacting support and waiting. This is worth asking before you connect anything, not after the first mistake happens.
Take the free 2-minute readiness assessment
Say a small service business connects an AI agent to handle incoming appointment requests by text. Done carelessly, that setup might be granted access to the owner's entire email account and full calendar, "just in case," because it was the fastest way to get the integration working. Done with scoped permissions, the same agent gets access only to a shared scheduling inbox and the calendar it's booking into — nothing else. Three months later, the business switches to a different customer-texting tool and disconnects the agent. In the first setup, nobody's fully sure what that agent could still access on the way out, or whether every permission actually got revoked. In the second, disconnecting it is a two-minute task, because it never had access to anything beyond its one job in the first place.
No, it isn't. If you're skeptical of handing an AI system access to your inbox or your customer list, that's not you being behind the times — that's a reasonable reaction to a genuinely new kind of risk, and you shouldn't let anyone talk you out of it. The honest answer is that no vendor can promise a system that's never wrong; what you can actually check is whether the vendor's setup follows the four practices above, and whether they'll show you, not just tell you, what an agent has access to. As one small business owner might put it, describing a realistic but illustrative scenario: "I asked our automation company to show me exactly what the AI could see and do before we turned it on. It took them twenty minutes to walk me through it. That twenty minutes told me more about whether I trusted them than anything in their sales pitch did." If a vendor can't or won't walk you through the equivalent of that conversation, that's a more useful signal than anything on their website — and a reason to keep looking, not a reason to give up on the idea entirely.
We scope every agent we set up to the specific workflow it's handling — not broad, standing access to your whole email or your whole customer database — and we show you exactly what it can touch before it goes live, plus an activity log so you can see what it's actually done, any time you want to check. That matters for security, but it also matters for growth: businesses that start with one tightly scoped agent and can actually see it working tend to hand over a second workflow, then a third, within a few months — the confidence compounds. Businesses that start with broad, unchecked access tend to stall out at one nervous integration and never expand, which caps how much time and revenue the system ever ends up recovering for them.
We also back this with a real guarantee, not a vague promise: try Unmanually for 60 days, and if it isn't working out, whatever's left of your prepaid balance converts to account credit. That's not a cash refund on usage you've already consumed, since that reflects real infrastructure cost already spent, but it does mean you're not taking on a security review and a financial risk at the same time.
Not ready to connect anything yet? That's completely fine — leave your email on our presale waitlist and we'll let you know as soon as our permission-scoping and activity-log tools are live for new customers, including founding-member presale pricing before it opens to everyone else this October.
1. IBM Security, "Cost of a Data Breach Report 2024," 2024 (global average cost across organizations of all sizes; small businesses are not broken out separately, but typically have fewer resources to contain and recover from an incident quickly).
2. OWASP, "OWASP Top 10 for LLM Applications," OWASP Foundation (industry security guidance for AI/LLM systems; "Excessive Agency" describes AI systems granted more permissions, autonomy, or functionality than their task requires).
The full pillar guide this article belongs to.
The oversight side of the same problem — catching mistakes before a customer sees them.
Access and control differ between the two paths — worth weighing alongside security.
Once it's securely scoped, here's how to tell if it's actually paying for itself.
Start here if you're not yet sure what you'd even be scoping access for.
It can be, if you set it up carefully. Give the agent access to only the specific inbox, calendar, or record type it needs for its task, not blanket access to everything. Make sure you can see a log of what it actually did. Require your approval before it does anything involving money or a customer-facing message, at least at first. And confirm you can undo an action it gets wrong. Skipping any of these is what turns a helpful tool into a real risk.
Excessive agency is a term from OWASP's Top 10 for LLM Applications, a widely used security checklist for AI systems. It means an AI agent has been given more access, more autonomy, or more built-in functionality than the task it's actually doing requires — for example, an agent that only needs to read appointment requests being given the ability to also delete customer records. The fix is to match the agent's access exactly to its job, not to whatever's most convenient to set up.
Take our free 2-minute readiness assessment — it walks through what to automate first at your business, and what deserves tighter access controls from day one.
Take the 2-min readiness assessment