AI agent permissions checklist

Start with the job, not the technology

The owner problem is usually simple: you want an AI assistant to save time without changing a booking, sending the wrong message or exposing customer information. Start by naming the one job you want help with. For example, the assistant might answer common service questions, collect enquiry details, prepare a draft follow-up, or help a customer find the right booking pathway.

This matters because broad “AI automation” thinking can lead to giving a tool too much access too soon. Australian guidance recommends identifying the business problem first, starting small, testing carefully and keeping human oversight. For a small business, that might mean trialling one website enquiry assistant before connecting email, calendar, CRM and payment workflows.

Sources: [1] [3]

Separate read access from action access

A useful way to scope permissions is to split them into two groups: what the assistant can read and what it can do. Read access might include public service descriptions, trading hours, approved FAQs, general booking rules or available appointment categories. Action access is more serious: creating a booking, updating a customer record, sending an email, cancelling an appointment or applying a discount.

Do not treat these as the same risk. It is often reasonable for an assistant to read approved business information and use it to answer questions. It is much riskier to let it write to your systems or send messages without review. Taking bookings also requires a compatible booking integration; a chatbot alone cannot confirm availability unless it is connected to a system that can check and reserve times properly.

Sources: [3]

Keep sensitive data and high-risk decisions out of scope

Mark sensitive information as off-limits before you connect anything. This includes passwords, payment details, private staff information, confidential supplier documents, customer records that are not needed for the task, and health, legal or financial information unless you have proper controls and a clear reason. If the assistant does not need the data to do its job, it should not have access to it.

Cyber guidance for small business warns that AI tools can introduce risks such as data leaks, privacy breaches, unreliable outputs and supply chain exposure. Some AI services may store or use submitted data depending on the provider and settings. That does not mean you should avoid AI altogether; it means you should use minimum access, check vendor data handling, and avoid putting personal or confidential information into prompts unless the arrangement has been reviewed.

Sources: [2] [3]

Set approval and handoff rules before launch

Human approval points are the difference between helpful automation and risky automation. Require a person to review refunds, cancellations, complaint responses, price exceptions, unusual booking requests, anything involving personal details, and any message that could create a commitment your business may not be able to keep. The assistant can prepare a draft, but a staff member should approve it before it is sent where the outcome matters.

Also decide when the assistant must stop answering and hand over. Good handoff triggers include uncertainty, upset customers, requests for legal or financial advice, questions outside your approved information, repeated customer confusion, and attempts to make the assistant ignore your rules. If the assistant is customer-facing, customers should know when they are dealing with AI rather than a person.

Sources: [1] [2] [3]

Test permissions with awkward real-world scenarios

Do not only test the happy path. Use common questions, edge cases and deliberately awkward prompts. Ask about outdated offers, unavailable appointments, custom pricing, refunds, angry complaints, medical or financial advice, and requests to reveal private information. You are testing whether the assistant stays inside the job you gave it, not whether it sounds polished.

Hypothetical example: a suburban physio clinic wants a website assistant to reduce repetitive reception calls. The safe version answers questions about opening hours, services, parking and what to bring to a first appointment. It can show booking options only through a compatible booking system, but it cannot take payment details, cancel appointments, give medical advice or promise a specific treatment outcome. If a customer describes pain symptoms or asks whether they need urgent care, it hands off to the clinic’s team or an appropriate emergency pathway rather than improvising.

Sources: [2] [3] [5]

Use this AI agent permissions checklist

Complete this checklist for one planned connection, such as your website chatbot to your booking calendar, before adding more apps. The goal is to create a plain-English permissions table that your owner, staff member or implementation partner can understand and review later.

Optional non-sensitive prompt for ChatGPT-assisted drafting: “Act as an operations assistant. Create a permissions table for a small Australian service business chatbot. Example business: a dog grooming salon. The chatbot can answer approved FAQs, collect a name and phone number, and show booking options through a compatible booking system. It must not take payment details, cancel bookings, change prices, send messages without approval, or access private staff notes. Include columns for tool, data it can read, actions allowed, actions blocked, human approval needed, responsible person and review date.”

• Name the business bottleneck the AI assistant is meant to solve.
• List each connected tool, such as website chat, booking calendar, email, CRM or enquiry form.
• Write what the assistant may read from each tool.
• Write what the assistant may create, update, send or delete, if anything.
• Block access to passwords, payment details, confidential files and unnecessary personal information.
• Decide which actions need human approval before anything is sent or changed.
• Set handoff triggers for complaints, uncertainty, sensitive topics and out-of-scope requests.
• Check the vendor’s privacy, data storage, data use and incident notification information.
• Confirm who in the business is accountable for the assistant.
• Test normal questions, edge cases and attempts to bypass your rules before launch.
• Record what you tested, what failed and what you changed.
• Set a review date after launch and nominate who will monitor issues.

Sources: [1] [2] [3]

Measure the result and know when to get help

After launch, measure the bottleneck you were trying to fix. Useful measures include fewer repetitive calls, faster enquiry triage, more complete enquiry details, fewer missed follow-ups, fewer manual copy-and-paste tasks, and the number of conversations handed to a human. Also measure problems: incorrect answers, blocked requests, customer confusion, privacy concerns and cases where staff had to fix the assistant’s work.

You need help when the assistant must connect to live systems, when permissions are hard to describe, when several staff need different access levels, or when a mistake could affect bookings, money, customer trust or personal information. You may also need help if your current website, booking process and follow-up process are messy; automation tends to expose those gaps rather than hide them.

Business Growth Clinic’s AI and automation work is relevant when you want a practical assistant grounded in approved business information, with booking or follow-up connections only where compatible and properly scoped. If you are planning to connect a chatbot to your website, calendar or enquiry process, the sensible next step is to map the permissions first, then explore implementation support once the boundaries are clear.

Sources: [6] [1]