We build agents for clients. Right now we're building one that triages support tickets for a US managed service provider before a technician picks them up. The hard decisions on that build aren't about the AI. They're about what it can see, what it can change and who checks its work.
Here's how we approach it, in the order we'd do it.
What is an AI agent, in plain English?
An AI agent is AI that can take actions for you using the tools you connect it to. Email, calendar, files, your CRM, your ticketing system. A chatbot answers a question. An agent answers it and then does something about it.
Agents are now arriving inside software you already pay for. In October Google announced Gemini "coworker" agents that get their own Workspace account, email address and place in your company directory. Microsoft and OpenAI are pushing agents into Copilot and ChatGPT too. For most businesses the first agent won't be a project. It'll be a setting someone switches on.
1. Give it one job before you give it any access
Write the job down in one sentence. "Sort incoming support tickets by urgency and send them to the right team." "Draft replies to quote requests for someone to check." If you can't write the sentence, you're not ready to switch it on.
The job decides the access. Without one, the easy default is to give the agent whatever the person setting it up can see. That's nearly always far too much.
2. What can an AI agent access? Check before you switch it on
Most agents see what's shared with them. Google says its coworker agent "sees only what you share with it". That sounds reassuring until you look at what's shared with everyone.
Plenty of businesses have folders that were opened up to the whole company years ago and never looked at again. An HR spreadsheet. Old pricing. A board pack someone shared with "anyone in the organisation" to save time. An agent that joins the company joins that audience.
Before anything goes live:
- List every system it connects to. Email, files, CRM, finance, ticketing. Each connection is a door.
- Find what's shared with everyone. Your IT provider can pull this report for Microsoft 365 or Google Workspace.
- Close what doesn't need to be open. Worth doing anyway. The agent just makes it urgent.
3. Decide which actions need a person's approval
Reading is one thing. Sending, deleting, paying and changing records is another. Sort every action the agent could take into three groups:
- Does it alone. Low risk and easy to undo. Tagging a ticket, filing an email, drafting a reply.
- Does it with a sign-off. Anything a customer sees or that moves money. A person approves it first.
- Never does it. Deleting records, changing bank details, giving itself more access.
The ticket triage we're building for our MSP client is deliberately rule-driven. It categorises and routes against rules the client agreed, with tight guardrails on what it can change. It's less clever on paper. It's also far more predictable, and that's the trade we'd make every time.
4. Give it a named owner
Every agent needs one person whose job includes it. Not "IT". A name.
The owner decides what the agent is for, signs off changes to its access and reads its activity log. Google's coworker agent records every action under the agent's own name. That log only helps if someone opens it, so put it in the owner's diary. Monthly is a sensible start. Check more often if it touches customers or money.
When someone leaves, you take their access away. Agents never hand their badge in, so review their access every quarter.
5. Treat it as handling personal data, because it is
If the agent can see customer or staff details, data protection law applies to what it does with them. The UK's Information Commissioner's Office put it plainly in October: "the fact AI agents act with autonomy is not an excuse for poor compliance." Outside the UK the rules differ, but I'd expect regulators to ask the same questions.
In practice that means writing down what each agent can access, what it may do without a person checking and who is responsible for it. If anyone asks, you can show your working.
6. Start small and measure it
Switch it on for one team and one job. Record what that job looks like today: hours spent, response times, mistakes. Then compare after a month.
Federal Reserve survey data published in October found 71% of US small businesses using AI said it made them more productive. Only 31% saw more sales from it. The survey doesn't say why. Our view, from the projects we see, is that focus makes the difference: pick one problem and measure it before and after. We cover the rest of that in why AI pilots fail.
A quick checklist before you switch an agent on
- The job is written down in one sentence.
- Every system it connects to is listed.
- Company-wide sharing has been checked and tidied.
- Every action is sorted into alone, with sign-off or never.
- A named owner has the activity log in their diary.
- Your data protection records say what it can see and do.
- You've measured the job today and set a date to check again.
Where we fit
Some of this is an afternoon with your IT provider. The rest is deciding which jobs are worth handing to an agent and building the rules around them, and that's what we do. We build agents with the permissions and checks designed in, then run them so they don't drift.
The AI Readiness Diagnostic is free and no-obligation. We look at how you work, pick the jobs worth automating and hand you a statement of work, a wireframe and an ROI case you keep whether or not we build anything.
If you're an IT provider, your clients are going to ask you about this. Our AI for MSPs page shows how we work alongside providers.
Common questions
Is it safe to give an AI agent access to company data?
It can be, if its access matches one clearly defined job. The risk usually isn't the AI. It's that agents inherit whatever is shared with them, and most businesses have files open to the whole company that shouldn't be. Tidy that sharing first, limit the agent to the systems its job needs, require a person's sign-off for anything customer-facing or financial and give it a named owner who reads its activity log.
What should an AI agent be allowed to do without approval?
Only actions that are low risk and easy to undo, such as tagging a ticket, filing an email or drafting a reply for someone to check. Anything a customer sees or that moves money should need a person's sign-off. Some actions should be off limits entirely, including deleting records, changing bank details and giving itself more access.
Who is responsible if an AI agent makes a mistake?
An agent acts on your behalf, so you can't hand the responsibility to the software. Your business still has to oversee what it does. If it handles personal data, data protection rules apply. In October the UK's Information Commissioner's Office said the fact AI agents act with autonomy is not an excuse for poor compliance. Wherever you operate, keep a record of what each agent can access, what it may do without a person checking and who owns it.
See it in practice: AI service desk for a US managed service provider →