AI agents now plug into all your business apps at once. The decision that matters is the one on the connect screen.

Last week Meta opened its AI agent, Muse, to small businesses, with connections to more than a dozen tools a small business already runs on — Shopify, Stripe, QuickBooks, Slack, Notion, Dropbox, Zoom and others, plus its own Facebook, Instagram and ad accounts. The pitch is simple and, honestly, sensible: an agent that can see your whole operation is more useful than a chatbot that can see one window. The day after, a US small business group reported that 58% of the small employers it surveyed already use AI agents at least occasionally.

So the question for most businesses is no longer whether an agent gets connected to things. It is which things, with what access, for how long — and that question gets answered in about four seconds, by whoever happens to click Allow.

The connect screen is a hiring decision

When you connect an app to an agent, you usually see a screen listing what it will be able to do: view your orders, manage your products, read your messages, create invoices. Almost nobody reads it, because the connection is the step standing between you and the demo working. But that screen is the real contract. Whatever the agent is told in its instructions, the access granted there is the outer limit of what it can do — and the outer limit of what a mistake, or someone feeding it bad instructions, can do through it.

Put it in staff terms. You would not hand a new starter the keys to the bank account, the customer list, the ad budget and the shared inbox on their first morning because it saves you showing them where things are. You would give them what the job needs and add to it when they had earned it. An agent connected to everything on day one is that new starter, minus the probation period.

Approval buttons cover actions, not access

To Meta's credit, it says nothing in Muse publishes, sends or spends without the owner's approval. That is the right instinct, and it is the same line we draw ourselves. But it is worth being precise about what an approval step does and doesn't cover.

• It covers the moment of action. A draft email, a post, a payment — you see it and say yes or no.
• It does not cover what the agent can read. Customer details, sales history, supplier pricing and staff messages are all visible to it the moment the connection is made, whether or not anything is ever sent.
• It does not cover time. A connection made in a ten-minute trial in March is usually still live in December, long after anyone remembers making it.
• It does not cover people. If the person who connected the tool leaves, the access often stays — tied to a login nobody is watching any more.

None of that is unique to Meta, or to AI. It is how app connections have always worked. What has changed is that the thing on the other end of the connection is now built to read widely and act, rather than to copy one field from one place to another.

Why “connect everything” is the default

Broad access makes the product look good. An agent that can see your sales, your ads and your inbox can answer a question that spans all three, and that is a far better demo than one that can only see your calendar. So onboarding flows nudge you towards connecting more, and the widest permission option is usually the one pre-selected.

There is nothing sinister in that. It is the same reason every phone app asks for your contacts. But it means the safe setting is almost never the default setting, and you have to choose it on purpose.

If you can't say in one sentence why the agent needs access to a system, it doesn't need access to it yet.

A twenty-minute audit worth doing this week

You don't need a security consultant for this. Most platforms you already use — your email, your accounting software, your payment provider, your online store — have a settings page listing the outside apps connected to them. Open each one and work down the list.

• Name what each connection is for. If nobody can, disconnect it. If it turns out to matter, you will find out quickly and can reconnect it in a minute.
• Check whether it can write, or only read. An agent that reports on your sales does not need permission to edit products or issue refunds. Where the platform lets you choose, choose read-only.
• Check whose login it hangs off. Connections made under a former staff member's account, or a personal account, are the ones that outlive everyone's memory of them.
• Keep anything that touches money or sends to customers behind a person. Reading and drafting are cheap to get wrong. Paying, refunding and sending are not.
• Put a date in the calendar to do it again. Connections accumulate quietly; a quarterly look is enough to keep the list honest.

Where we land on it

We build our own agents to the narrow version of this. In Dispatch, the AI drafts replies to enquiries from your own price list, and a person still presses send. That keeps the agent's reach to the job it is actually doing. We have written about the other half of the problem — messages that can give your AI orders — and the two fit together: the less an agent can reach, the less a bad instruction can do with it.

Connected agents are going to be genuinely useful, and the businesses that use them well will save real hours. The ones that get burned won't mostly be burned by a bad model. They will be burned by a connection someone made in a hurry, with the widest permissions on offer, that nobody looked at again. Read the connect screen. Give the agent the job, not the keys.