What should you check before giving an AI tool access to your business?
Before you connect any AI tool to your files, email, or messages, ask four things: what it can read, what it can do without asking, where its work is recorded, and how you revoke access. If the honest answer is "it acts on its own," treat that as a commitment you did not intend to make.
New AI tools ship every week, and each one asks for the same thing: access. Access to your document store, your inbox, your calendar, your chat. Owners approve these connections the way they approve a new spreadsheet plugin — quickly, because it looks like normal software. It is not. A tool that can both read your files and take actions in your name is a standing decision to trust it, made once and rarely revisited.
This guide is the short test to run first. It works whether the tool is a chatbot, a browser extension, or a full "agent" — software that chains steps together to complete a task on its own.
Why is granting AI access a commitment, not a setting?
Granting access is a commitment because it is durable, broad, and usually invisible after the fact. A permission you click through in ten seconds keeps working every day until you remember to remove it. The tool doesn't ask again. That gap between one quick approval and ongoing authority is where the risk lives.
Vantrow's guiding principle is "propose, never commit": software should stage an action and wait for a human to approve it, rather than acting on its own. Access grants invert that. Most tools ask you to commit up front — full read and write — and then propose nothing afterward. You want the reverse: minimal standing access, and a person in the loop for anything that changes your data or reaches your clients.
- Durable: the grant outlives the reason you made it.
- Broad: "read your files" usually means all of them, not the one folder you had in mind.
- Invisible: once approved, the tool works silently, so mistakes surface late.
What are the four questions to ask before granting access?
Ask these four, in order, and refuse to connect anything that can't answer them plainly. The test takes five minutes and filters out most of the tools that would cause you trouble.
1. What can it read — and is that the minimum?
Start with scope. A calendar assistant does not need your entire document store; an intake tool does not need your accounting files. If the only access option is "everything," that is a red flag, not a convenience. Prefer tools that connect to one folder, one inbox label, or one project — and expand only after they've earned it.
2. What can it do without asking me?
This is the question that matters most. Reading is one risk; acting is another. Can the tool send email, delete records, move money, post to a client, or change a file — with no human approving the specific action? A tool that drafts and waits is safe. A tool that sends on its own is a decision you've delegated. According to Stanford HAI's 2024 AI Index, AI-related incidents tracked by the AI Incident Database have risen sharply year over year — most of the avoidable ones involve systems acting without a check in place.
3. Where does its work get recorded?
Every action the tool takes should land somewhere you can review later: an audit trail — a timestamped log of what happened, who or what triggered it, and what changed. If you can't answer "what did this tool do last Tuesday?", you don't have governance, you have hope. Named users, timestamps, and a reversible record are the minimum.
4. How do I turn it off — today, not next quarter?
Revocation should be one click and take effect immediately. Before you connect anything, find the "disconnect" button and confirm it exists. If removing access requires an email to support or a 30-day notice, you don't control the tool — it controls the relationship.
How should a careful operator actually roll this out?
Grant the least access that lets the tool prove useful, keep a human on every action that touches clients or money, and review the log weekly for the first month. Widen access only after the tool has earned it. This mirrors how you'd onboard a new hire — trust in stages, not all at once.
- Start read-only. Let the tool observe and draft before it can send or change anything.
- Scope to one area. One folder, one inbox, one project — not the whole company.
- Keep the human send. The desk drafts; a person approves and sends. That single rule prevents most of the damage an eager tool can do.
- Review the trail. Spend ten minutes a week reading what the tool did. If you can't, it has too much authority.
- Expand slowly. More access is a reward for reliability, not a starting condition.
The pattern here isn't caution for its own sake. It's the difference between software that proposes and software that commits — and for an operating company, that difference is your name on every action a tool takes.
FAQ
Is it ever safe to let an AI tool act without approval?
For low-stakes, reversible tasks inside a narrow scope — sorting a folder, tagging emails — yes. For anything that reaches a client, moves money, or deletes data, keep a human approving the specific action. The rule scales with the cost of being wrong.
What's the difference between an AI assistant and an AI agent?
An assistant answers or drafts and waits for you. An agent chains steps together to complete a task on its own, which means it can also take actions on its own. Agents demand stricter access limits precisely because acting — not reading — is where the risk concentrates.
What is an audit trail and why does it matter?
An audit trail is a timestamped record of every action a tool took, what triggered it, and what changed. It matters because it lets you review, explain, and reverse what happened. Without one, a mistake is invisible until a client or a regulator finds it for you.
How much access should a new AI tool get on day one?
The minimum that lets it prove useful — usually read-only access to one folder or inbox. Broad, write-enabled access should be earned through a track record, not granted at setup because the tool asked for it.
Can I revoke access after I've connected a tool?
You should be able to, in one click, with immediate effect — and you should confirm that button exists before you connect. If revocation is slow or requires contacting support, treat that as a reason not to grant access in the first place.