AI Agents for Small Business: 5 Security Rules for 2026
What happens when the assistant you set up to sort your inbox reads an email that tells it to forward every invoice to an outside address? If the assistant has permission to send email, it might do exactly that.
That is the new risk with AI agents for small business. A chatbot answers questions. An agent takes action. It reads your mail, opens files, updates your CRM, books meetings, and in some setups, approves payments. Gartner expects 40% of enterprise applications to include task-specific AI agents by the end of 2026, up from less than 5% in 2025. The tools you already pay for, from Microsoft 365 to your CRM to your accounting software, are adding agent features whether you asked for them or not.
For a 35-person CPA firm in Grand Rapids or a 60-person manufacturer in Holland, that is a real productivity gain. It is also a new kind of user on your network, one that never sleeps, works faster than any person, and follows instructions from anyone who can get text in front of it.
Here are the five rules we set with West Michigan clients before any agent goes live.
What Makes AI Agents Different From Chatbots
An AI agent is software that uses a language model to plan and complete multi-step tasks on its own, using the logins and permissions you give it.
That last part matters most. When an employee uses ChatGPT or Claude to draft a memo, the worst case is a bad memo. When an agent has access to your shared drive, your email, and your QuickBooks file, the worst case is whatever those permissions allow.
The OWASP Top 10 for Agentic Applications, released in December 2025 by more than 100 security researchers, lists the main ways agents fail. The top two are "agent goal hijack" and "tool misuse." In plain terms: someone tricks the agent into doing something you never intended, using tools you handed it.
The most common trick is called prompt injection. An attacker hides instructions inside content the agent will read, such as an email, a PDF, a web page, or a calendar invite. The agent cannot reliably tell the difference between your instructions and the attacker's. Gartner predicts that through 2029, more than half of successful attacks on AI agents will exploit access control weaknesses, with prompt injection as the way in.
The lesson: you cannot fully stop an agent from being tricked. You can limit what a tricked agent is able to do.
Rule 1: Give Every AI Agent Its Own Identity
Every agent should log in as itself, never as a person.
Many small businesses connect an agent using the owner's or office manager's account because it is fast. Now the agent has that person's full access, and your logs cannot tell you whether a file was moved by Sarah or by the bot.
Create a dedicated service identity for each agent in Microsoft Entra ID, Google Workspace, or whatever identity system you run. Name it clearly (for example, "agent-invoice-intake"). Assign an owner who is accountable for it. Turn on logging. When the project ends or the agent misbehaves, you disable one account instead of resetting a person's password and breaking their day.
Rule 2: Start With Read-Only Access
Grant the minimum permissions the task needs, and start with read-only.
An agent that summarizes client emails needs to read one mailbox. It does not need to send mail, delete mail, or read every mailbox in the tenant. An agent that drafts proposals needs read access to a templates folder, not your entire SharePoint.
Write access should be earned, one system at a time, after the agent has run in read-only mode long enough for you to trust its output. For law firms and accounting firms, this is also a confidentiality question. An agent with broad access to client files is a disclosure risk even when nobody attacks it. Our guides on cybersecurity for law firms and cybersecurity for accounting firms cover how client-data rules apply to new tools like this.
Rule 3: Put a Human Checkpoint on Money, Data, and Deletes
Any action that moves money, sends data outside the company, or deletes records should require a person to click approve.
This is the single most effective control for AI agents in a small business. Prompt injection works because the agent acts on its own. A human approval step breaks that chain.
Practical examples:
- The agent can draft a vendor payment. A person releases it.
- The agent can prepare an email with attachments to an outside address. A person sends it.
- The agent can flag duplicate CRM records. A person merges or deletes them.
Yes, this slows the agent down. That is the point. Save full autonomy for low-risk, reversible tasks like tagging tickets or summarizing meetings.
Rule 4: Control What the Agent Reads
Treat every outside document, email, and web page an agent reads as untrusted input.
Because prompt injection rides in on content, the sources you let an agent read are part of your security perimeter. An agent that only reads your internal knowledge base is much safer than one that browses the open web and opens every email attachment.
Ask three questions for each agent:
- What content sources can it read?
- Can outsiders put content into those sources (email, web forms, shared folders, support tickets)?
- If they can, what is the worst action the agent could take after reading it?
If the answer to question 3 is "send our client list to a stranger," go back to Rules 2 and 3.
Rule 5: Inventory Every Agent, Including the Ones Nobody Approved
You cannot secure agents you do not know about. Keep a written list of every agent, what it connects to, who owns it, and when it was last reviewed.
Shadow AI is now shadow agents. Employees are connecting free browser extensions, no-code automation tools, and AI add-ons to company email and storage with a couple of clicks. Each one is a new identity with access to company data, and most never show up on an IT ticket.
A quarterly review should check:
- Which third-party apps have OAuth consent to your Microsoft 365 or Google tenant
- Which agents have write access, and whether they still need it
- Which agents belong to employees who have left
- Whether logs show any actions outside the agent's normal pattern
This is the same discipline we covered in our post on writing an AI policy for small business, applied to tools that act instead of just answer.
Who Should Own AI Agent Security in a 20 to 100 Person Company?
In most Michigan SMBs, nobody owns it yet, and that is the gap.
Your IT provider manages devices and accounts. Your department heads pick the software. The agent features arrive inside that software through an update. Nobody is assigned to decide which agents are allowed, what they can touch, and who reviews them.
That is the role of a fractional AI leader. A virtual Chief AI Officer (vCAIO) sets the rules for AI tools and agents, and a virtual CISO makes sure those rules fit your security program, cyber insurance requirements, and compliance obligations. For healthcare practices, that includes keeping agents away from protected health information unless a business associate agreement covers the vendor. Our healthcare cybersecurity page covers those rules.
The NIST AI Risk Management Framework is a solid, free starting point for structuring that governance, even for a small team.
Frequently Asked Questions About AI Agents for Small Business
What is an AI agent?
An AI agent is software that uses a large language model to plan and carry out tasks on its own, such as reading email, updating records, or scheduling meetings, using permissions you grant it. Evolv Technology Solutions treats every AI agent as a new user account that needs its own identity, limited access, and an owner.
Are AI agents safe for small businesses to use?
AI agents are safe enough for small businesses when they run with least-privilege access and a human approves high-risk actions. The danger comes from broad permissions, not from the AI itself. Evolv recommends starting every agent in read-only mode and adding write access one system at a time.
What is prompt injection?
Prompt injection is an attack where hidden instructions inside an email, document, or web page trick an AI agent into doing something its owner did not intend, such as forwarding files or changing records. Evolv's position is that you cannot fully prevent prompt injection, so you must limit what an agent is allowed to do if it is tricked.
Does Microsoft 365 Copilot count as an AI agent?
Microsoft 365 Copilot can act as an agent when it is connected to actions or custom agents that send mail, edit files, or update other systems. Basic Copilot chat that drafts text is lower risk. Evolv reviews Copilot permissions and data access settings for Grand Rapids clients before agent features are turned on.
Who should manage AI agent security at a small business?
A named owner should approve, inventory, and review every AI agent, usually a vCAIO or vCISO working with your IT provider. Evolv Technology Solutions provides fractional AI and security leadership for West Michigan SMBs that do not need a full-time executive in either role.
Get an AI Agent Review Before You Turn One On
AI agents will save your team hours each week. They will also open doors you did not know existed if you set them up the fast way.
Evolv Technology Solutions helps Grand Rapids and West Michigan businesses inventory the AI tools already connected to their systems, set least-privilege permissions, and build approval checkpoints that keep agents useful and contained. Book a free consultation at evolvtechsolutions.com and we will walk through the agents you are running today and the ones on your roadmap.