Five controls every small-business AI agent needs

An AI agent differs from a chatbot in one way that matters to an owner: it does things. It sends the email, issues the refund, updates the record, books the slot. That is why it saves time, and also why it needs the limits you would give a new member of staff on their first week. These five AI agent controls are what we would put in place first.

2026 is the year the rules for those limits started to settle. Here are five, in order of how much trouble they prevent.

1. Give it the least access that does the job

On 1 September OWASP, the open security community whose lists most developers work from, published its 2026 Top 10 for applications built on large language models. Excessive agency, meaning an AI that has more permissions than its task needs, is third on the list. OWASP also published a separate Top 10 for agentic applications in December 2025.

In practice this means:

• An agent that drafts replies does not need permission to send them.
• An agent that reads orders does not need permission to refund them.
• An agent gets its own account and API keys, not an admin’s login, so you can see what it did and cut it off without locking out a person.

Start with read-only access and add each permission when there is a reason you can say out loud.

2. A person approves money, messages and deletions

Prompt injection is the attack where someone hides instructions inside content the agent reads: an email, a web page, a product review, a PDF. The agent cannot always tell your instructions from theirs. No vendor claims to have solved it, and OWASP lists it first.

The working answer is a human step before anything that is hard to undo. Refunds, payments, emails or messages to customers, changes to prices, deleting records: the agent prepares, a person clicks approve. For most small businesses this keeps nearly all of the time saved, because preparing is the slow part.

3. Tell people when they are talking to an AI

The EU’s AI Act has rules on transparency, in Article 50. Since 2 August 2026, people must be told when they are dealing with an AI system. This summer the EU agreed a package of changes that pushed back the rules for high-risk uses, such as AI used in hiring, to 2 December 2027. Chatbot disclosure was not delayed. Marking of AI-generated content has a short grace period to 2 December 2026 for systems already on the market.

If you have customers in the EU, a chat assistant or an AI voice agent on your site needs to say what it is. It is good practice everywhere else too. Baymard Institute’s October survey of 2,273 US shoppers found that most are happy to use AI to compare products or check stock, but when an order goes wrong, 69% want a human for damaged or wrong items and 67% for late deliveries. Make the way to a person obvious.

4. Keep a list of every agent

Big companies now buy software just to find and govern their AI agents. Microsoft’s Agent 365, released in May at $15 per user per month, can even look for “shadow” agents that staff set up on their own.

A small business needs a shared sheet, kept current, with one row per agent:

• what it does and which tools it can touch;
• whose account and API keys it uses;
• who on the team owns it;
• how to switch it off.

If an agent misbehaves at 9pm on a Friday, the person on call should be able to stop it in two minutes from that sheet.

5. Log what it does, and cap what it spends

Every action an agent takes should be written to a log you can read: what it saw, what it decided and what it changed. When something goes wrong, the log is how you find out why, and how you show a customer what happened.

Set spending limits with the model provider and in your own code. Prices are falling (Anthropic cut Claude Opus 5.5 to $4 per million input tokens in September, from $5), but an agent stuck in a loop can still run up a bill overnight. Google described its new Gemini agent in October as having “built-in cost controls”, which tells you how common the problem is.

Put together

None of these controls needs a large budget. Most are decisions: which permissions, which steps need a human, which sentence tells a customer they are talking to an AI, which sheet lists your agents. Make them before the agent goes live, because adding limits after something has gone wrong is harder and more expensive.

If you already have an agent running, go through the five against it this week. Most need an hour or two each.

Where to start with AI agent controls

Start with the agent that can touch money or customers, and add these AI agent controls before anything else. Our AI agent development team builds them in from the first version. Read also what to settle before you pay for an AI agent.