Give an AI tool the lowest level of access that does the job, and add more only after it has proven itself at the level it has. In practice that means five rungs. A tool reads one system, then several, then drafts changes for your approval, then carries out approved changes, and only at the top acts alone. Reading comes before writing, one system comes before many, and you should know how to revoke access before you grant it.
The question applies more widely than the word "agent" suggests. Most owners meet it first in an ordinary chat tool like ChatGPT or Claude, the moment it offers to connect to Gmail, Google Calendar, or QuickBooks. That offer comes through a connector, a prebuilt link that lets the AI model see inside another piece of software. An agent is the next step, a model that takes actions with tools in a loop until a job is finished, and what an AI agent is, starting with what came before covers it from the ground up. The permission decision is the same for both, with higher stakes for the agent.
What does a permission actually grant?
A permission is a specific thing a connection lets the tool see or do. When you click "Allow" on a screen asking to link an app to your Google account, you are approving a list, and the list is often broader than the job you had in mind. You wanted the tool to find Thursday's appointments. Yet the screen may also grant it the ability to create, edit, and delete events.
Security people have a name for that gap. The OWASP GenAI Security Project, which publishes widely used security checklists, calls it excessive agency, and traces it to three causes. Either the tool has more functions than the task needs, more permissions in other systems than it needs, or more freedom to take high-impact actions without anyone checking. Each one is a separate dial, and each one can be turned down.
The line between looking and doing can also move without your noticing. Anthropic's help page for Claude's Google Workspace connectors describes a Gmail connection that can send, reply, and forward, and asks for your approval before each of those actions by default. On team plans an administrator can change that default. The plug that reads your inbox can also write to it, and which of the two it does is a setting.
The access ladder
Climb it one rung at a time, and stay on a rung until the tool has earned the next one.
Five steps of access, from reading one system to acting alone, with revoking always available
Read one system
Read several
Draft for your approval
Act with approval
Act alone
you can still revoke
On the first rung the tool sees a single system and nothing else. A pest-control company connects its job list, and the model can say which houses are due this week and which are rained out, but it can't move a single appointment.
The second rung is where reading gets useful, because the model can join pieces that live apart. An accounting practice that connects the filing-deadline calendar and the client email folder can ask which clients have a deadline in ten days and haven't sent their documents. Neither system answers that alone. It's also the rung where exposure grows fastest, since a tool that can see the inbox and the books together knows more than either one does.
Drafting is the rung many owners never need to leave. A salon has the model read the schedule and write the reminder texts, and the front desk sends them. The work gets done, and nothing reaches a customer that a person didn't look at first.
Acting with approval shrinks your part to a click. A lodging owner lets the tool take a cancellation, offer the open nights to the waitlist, and update the booking calendar, with a yes from the owner at each step. Most well-built agents stop and ask before anything they can't undo, such as sending, deleting, or spending, and keeping those prompts switched on costs very little.
Acting alone is the top, and it suits one specific, repeatable job that has run clean at the rung below for a long time. A plumbing shop that has approved the same parts-reorder dozens of times without changing a word may be ready to let that one job run. Its customer messages stay a rung lower. Checking on a tool that acts alone is the part I don't have a clean answer for. Most vendors keep logs of what their tools did, and whether a busy owner reads them every week in the middle of a season is another question.
The first two rungs are reading, and the last three are delegating. The four levels of AI use put reading at Level 3 and delegating at Level 4, and nothing about the ladder says you have to finish it. Choosing what to hand over in the first place is a separate decision, the one AI automation for small business takes up.
Why one system before many?
Every connection adds to what a mistake can reach. A tool that can read the inbox and write to the books can turn one misread email into a wrong entry, and nobody may notice until month-end. Connecting one system first keeps a bad day small and teaches you how the tool behaves before the damage it could do multiplies.
There's a second reason, which is that it's easier to judge. When a retail shop connects only its point-of-sale data and the model says a sweater sold out in October, the owner can check that in a minute. Add three more systems and the answer may be right for reasons you can't trace.
The first thing I look for on any connection screen is whether reading and writing come as one checkbox or two. When they're bundled, I assume the tool will eventually use the half I didn't need.
How do you take access back?
Find the revoke page before you connect anything. Google keeps a linked apps page that lists every app with access to your account and removes one in a few clicks. Its help page is careful to say that removing a sign-in link doesn't delete your data on the app, and it points you to the developer's privacy policy for what they keep. Revoking stops future access, and whatever already left stays wherever it went.
Most other services you connect, the AI products included, have their own version of that page somewhere in account settings. Bookmark each one when you make the connection, and look at the list every few months. Expect at least one entry you forgot you approved. The plumbing behind these connections, usually an API or the newer standard called MCP, is explained in what MCP is, in plain English.