[{"data":1,"prerenderedAt":174},["ShallowReactive",2],{"publication:en:P090":3},{"meta":4,"copy":17,"relatedArticles":134,"terms":166,"term":167,"resourceParent":168,"glossaryParent":171},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":15,"preparedOn":16},"P090","\u002Fblog\u002Fai-agent-permissions","article","AI agent permissions for business","AI agent permissions for business: control tools, data and actions","AI agent permissions: tools, data and approval","Review AI agent tools, identities, read access and business actions. Define approval, logs and a shutdown route before connecting customer systems.",[13,14],"\u002Fservices\u002Fcrm-integrations","\u002Fservices\u002Faccess-2fa-audit","2026-07-22","2026-10-30",{"intro":18,"sections":19,"checklist":92,"faq":100,"links":110,"sources":127,"cta":129},"AI agent permissions define what an assistant can read, which tools it can call and what business changes it may execute. Review the actual connected identity and downstream authorization, not just the conversational instructions. A narrow task should have a narrow capability, an accountable owner and a supported way to stop it.",[20,26,66,72,78,86],{"title":21,"paragraphs":22},"Write the permitted task before connecting an account",[23,24,25],"“Help with customer support” leaves too many decisions open. “Prepare a draft summary of the assigned ticket for its current handler” identifies a record, audience and output. Sending a response, changing a customer status or searching other tickets are additional capabilities that require their own justification.","List the normal result and the operations that should never be needed. Include the account that owns the integration, who can alter its settings and where credentials are managed. A temporary experiment using a business owner’s broad account can quietly become a permanent production dependency if nobody owns the cleanup.","Review the whole chain when one assistant calls another workflow. A narrow-looking interface may still use a powerful shared identity downstream. Ask the administrator for the effective permissions and execution behavior, rather than accepting the button label as a description of the real access.",{"title":27,"paragraphs":28,"sources":31,"table":35},"Review tools, permissions and autonomy as separate decisions",[29,30],"OWASP LLM06:2025 distinguishes excessive functionality, excessive permissions and excessive autonomy. An agent may have an unnecessary tool, use an unnecessarily powerful identity, or take a high-impact action without independent approval. Fixing one of these does not automatically fix the others.","The following matrix is an original review aid for a hypothetical ticket-summary workflow. Adapt the decisions to the actual product and business process. Do not grant capabilities merely to make every feature available for a possible future use.",[32],{"label":33,"url":34},"OWASP LLM06:2025: excessive functionality, permissions and autonomy","https:\u002F\u002Fgenai.owasp.org\u002Fllmrisk\u002Fllm062025-excessive-agency\u002F",{"caption":36,"headers":37,"rows":41},"AI agent task, capability and approval matrix",[38,39,40],"Capability","Minimum proposed scope","Acceptance question",[42,46,50,54,58,62],[43,44,45],"Read a ticket","Only records the requesting handler may access","Is record authorization checked before retrieval?",[47,48,49],"Retrieve reference text","Approved knowledge sources for this task","Can unrelated private folders remain inaccessible?",[51,52,53],"Produce a summary","Draft visible to the authorized handler","Is the output clearly a draft requiring review?",[55,56,57],"Send an external message","Excluded from the summary task","Is sending unavailable rather than merely discouraged?",[59,60,61],"Change or delete records","Excluded unless separately justified","Are downstream write permissions absent?",[63,64,65],"Approve a sensitive operation","Named authorized reviewer and exact operation","Can model output bypass or manufacture approval?",{"title":67,"paragraphs":68},"Check the identity and records behind every connection",[69,70,71],"Establish whether the integration acts as the current user, a service identity or a shared administrator. Inspect actual granted scopes, role assignments and record-level checks. The right answer depends on the application; a claim that it “uses OAuth” does not by itself tell you which data or operations were granted.","Keep credentials outside prompts, instructions and ordinary review documents. Reference the controlled credential location and recovery owner instead. Avoid reusing a general administrator identity where a narrower supported identity will serve the task. Changing a credential without checking dependencies may interrupt other automations, so plan revocation and replacement with the owner.","Review read access in detail. Summarizing a ticket does not necessarily require every attachment, all historic customer records or the full company mailbox. Test with authorized synthetic records on both sides of the boundary: the intended record should work, while an unrelated record should remain unavailable. Do not browse real unrelated customer information to demonstrate a permission concern.",{"title":73,"paragraphs":74},"Make approval specific to the operation that will execute",[75,76,77],"A person approving a connection is not approving every future action. For sensitive operations, show the actual recipient, record, content and consequence before execution. The action handler must verify authorization and any required approval for that operation. The model should not be able to skip the check by describing the action as routine.","Decide what happens if the proposed operation changes after approval or if the task is retried. A reviewer who approved a draft addressed to one recipient has not approved a different recipient or attachment. Application owners should also consider duplicate operations, expiry of approval and limits on the number or value of changes, where relevant.","Keep the initial deployment conservative. Preparation and review can deliver useful work without automatic publication, deletion or payment. Introduce a broader operation only when its authorization, error handling and recovery options have been reviewed. Human involvement is meaningful when the reviewer can understand the exact action and decline it before it happens.",{"title":79,"paragraphs":80,"example":83},"Prove a useful result without enabling unnecessary actions",[81,82],"Prepare a controlled acceptance record with the intended task, permitted inputs, expected output, prohibited operations and observations. Include normal use, denied access and interruption. A good summary is only part of success: the integration should also refuse an unrelated record and remain unable to send when sending is outside its scope.","Inspect the resulting logs for a useful event trail without collecting whole sensitive documents unnecessarily. Capture task identity, tool operation, decision, object reference and result where the platform supports them. Note gaps explicitly. A model’s narration that it performed an action is not the authoritative record of what the target system accepted.",{"title":84,"text":85},"Illustrative example: summarize a ticket, do not send the reply","A fictional support assistant reads an assigned synthetic ticket and creates a summary for the handler. Its tool set excludes sending and deletion, and the connected identity cannot modify tickets. The handler reviews the summary and uses the normal business process for any real response. This is a proposed permission design, not a claim that a named platform exposes those exact controls.",{"title":87,"paragraphs":88},"Keep an owner, a stop route and a review trigger",[89,90,91],"Record who can disable the schedule, disconnect a tool, revoke the actual credential and inspect the target system. Those can be different controls. Stopping the chat interface may leave a scheduled integration running; removing one user may leave a service token active. The handover should identify each relevant route and its business dependencies.","Review permissions when a tool is added, a workflow changes, a vendor relationship ends or access roles change. Remove unused trial connections through an authorized change process and verify that the intended route has actually closed. Preserve the evidence needed to investigate unexpected actions before it is lost to routine log rotation.","CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide, with practical Israeli knowledge of business websites, accounts and digital infrastructure. We can discuss the access and integration boundaries around an AI workflow within an agreed scope. Send a description of the task and systems, not tokens or customer exports; specialist platform work and business approvals must be defined explicitly.",[93,94,95,96,97,98,99],"Specify one task, record set, audience and permitted result.","Inventory every tool, downstream identity and granted scope.","Separate necessary read access from write, send and delete capabilities.","Check authorization in the target system for each operation.","Make high-impact approval specific and enforceable.","Use synthetic allowed and denied records for controlled acceptance.","Record logs, credential owner, stop route and change-review triggers.",[101,104,107],{"question":102,"answer":103},"Does read-only mean there is no AI-agent risk?","No: read scope and output audience still matter because an assistant can disclose information it can retrieve. Excluding changes reduces some risks but does not establish appropriate data access.",{"question":105,"answer":106},"Can a system prompt enforce the agent’s permissions?","It can guide behavior, but effective authorization belongs in the tools and downstream systems. A model-generated claim that an action is permitted must not grant access or replace approval.",{"question":108,"answer":109},"Is disconnecting the chat enough to stop the integration?","Check the actual implementation. Schedules, service identities, tokens and downstream automations can have separate lifecycles. Document and verify the relevant stop and revocation controls.",[111,114,117,120,123,125],{"path":112,"label":113},"\u002Fblog\u002Femployee-ai-data-policy","Define employee use and information rules",{"path":115,"label":116},"\u002Fblog\u002Fprompt-injection-business","Review untrusted content and authority boundaries",{"path":118,"label":119},"\u002Fblog\u002Fvendor-access-review","Tie connected access to an owner and expiry decision",{"path":121,"label":122},"\u002Fglossary\u002Fleast-privilege","Apply least privilege to the intended task",{"path":14,"label":124},"Review account and permission scope",{"path":13,"label":126},"Discuss controlled website and CRM integrations",[128],{"label":33,"url":34},{"title":130,"description":131,"button":132,"type":133},"Map the permissions behind an AI-enabled integration","Tell us the task, connected systems, account ownership and actions available. CyberFixCrew can help define the access-review scope before customer data or live operations are involved.","Discuss connected access permissions","check",[135,144,151,159],{"id":136,"path":137,"title":138,"description":139,"category":140,"artwork":141,"order":142,"publishedOn":143},"P096","\u002Fblog\u002Fbusiness-data-map","Business website data mapping: follow each enquiry and copy","Map website data from forms to email, CRM, logs and backups. Record purpose, access, retention owners and gaps without collecting real customer data.","governance","integrations",60,"2026-07-06",{"id":145,"path":115,"title":146,"description":147,"category":140,"artwork":148,"order":149,"publishedOn":150},"P089","Prompt injection risks for business: separate content from authority","Understand prompt injection in business AI workflows. Map untrusted content, connected data and action controls without relying on prompts alone.","security",76,"2026-08-07",{"id":152,"path":153,"title":154,"description":155,"category":140,"artwork":156,"order":157,"publishedOn":158},"P097","\u002Fblog\u002Fdelete-old-form-data","Delete old website form submissions: plan scope before removal","Plan deletion of old form submissions across WordPress, email, CRM and exports. Check authorization, retention decisions and backup limits before removing data.","backups",54,"2026-06-20",{"id":160,"path":112,"title":161,"description":162,"category":140,"artwork":163,"order":164,"publishedOn":165},"P088","Employee AI data policy for a small business","Build an employee AI data policy around approved tasks, accounts, information and connectors. Use synthetic examples and clear exception and reporting routes.","access",84,"2026-08-21",[],null,{"path":169,"label":170},"\u002Fresources","Website security resources and templates",{"path":172,"label":173},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134059448]