Sunday morning, a new hire
The new employee starts today. This morning they get a door badge, access to the stockroom and a laptop. Nobody hands them the bank password, the company credit card, or the key ring that also opens your home. Not because you don't trust them. Because that's how a business is run.
With an AI agent the principle is exactly the same, except that with an agent nobody says it out loud.
AI agent security starts with one simple question: what does the agent get on day one, and what stays locked? When it's set up right, an agent can work on your website, content and campaigns without spending a cent, publishing a word or messaging a customer unless you approve it. This guide is the key ring: what to hand over, what not to, and how to check that it's really the case.
In short
- A safe AI agent for business gets its own dedicated identity in every system, the minimum permission it needs, and an approval gate on every action that costs money, gets published, gets deleted or reaches a customer.
- The iron rules: a separate key for every door, read before write, spending caps at the platform level, an action log, a backup, and a way to cut off access in a minute.
- The agent does on its own whatever can be undone, prepares a draft, and asks about anything hard to reverse. It never touches passwords, payment details or systems that weren't connected to it.
- No single safeguard is enough. So you combine permissions, approvals, caps and a log, and start with narrow access that you widen as you gain experience.
One key ring for every door, or a key for each door?
The most common mistake we see when businesses connect an agent: "the simplest thing is to give it my password." It works fast. Then you can't tell who did what, and you can't shut off access without changing your own password everywhere.
One key ring: your password
The short, risky way
- The agent can do everything you can, including what it doesn't need
- In the system logs, its actions look like yours
- Cutting off access means changing your password in every system
- A mistake or a malicious instruction inherits all your permissions
A separate key for every door
The right way
- A dedicated user in each system, with a name that shows it's the agent
- Every action is identified in the system's own log
- Revoking one key doesn't touch any other key
- What a key doesn't open, the agent simply can't do
This is also what OWASP, the security organization behind the leading list of risks for systems built on language models, calls "Excessive Agency." According to OWASP, the problem comes from three things: too much functionality, too many permissions and too much autonomy, with no human approval for significant actions. Its recommendation: limit the tools the agent can call, limit their permissions to the minimum, and require human approval for high-impact actions.
The traffic light: what the agent does alone, what waits for approval, and what is never allowed
Most arguments about "whether to trust an agent" fall apart once you stop talking about the agent and start talking about the action. An action you can undo with one click is not an action that costs money. OpenAI's guide to building agents suggests rating each tool as low, medium or high risk based on several factors: read-only or write access, whether it's reversible, which account permissions it needs, and its financial impact. And sensitive actions that can't be reversed or carry high risk should stop at a human, such as canceling orders, large refunds and payments.
We turn that into a traffic light you can print and hang above your screen:
The permissions traffic light
Green: the agent does it alone
- Reading, checking and analysis
- Reports and summaries
- Drafts of pages, products and posts
- Troubleshooting and suggesting a fix
- Writing to the log
Orange: prepares and asks
- Publishing on the website and social networks
- Launching a campaign or changing a budget
- A message to a customer on behalf of the business
- A significant change to the site or its settings
- Updating a live site
Red: never
- Passwords, credit card and bank account details
- Moving money and purchases
- Deletion that can't be recovered
- Changing permissions, DNS and accounts
- Systems and customers that weren't connected to it
Our own breakdown, based on the principles from OWASP and OpenAI's guide to building agents.
Note that orange doesn't mean "maybe." Orange means "after you said yes." And what's in red doesn't wait for approval at all, because there's no key for it. Moving money, passwords and permission changes are never connected to the agent in the first place, and if you need them, you do them yourself.
Four steps at the approval gate
An approval isn't an annoying pop-up. When it's built right, it looks like a single Telegram message. OpenAI's document on approvals describes the same principle on the technical side: the run stops before the action, waits for a human decision, and continues only after approval. Here's how it looks for you:
What a good approval gate looks like
- The agent preparesA draft, not a publication
- Sends a messageWhat will happen, where and at what cost
- You decideYes, no or fix it
- Done and loggedAnd the result comes back to you
A good approval message answers three questions without making you dig: what exactly will change, where, and what will it cost. "Launch the campaign?" is a bad message. "Launch campaign X with a daily budget of Y, through Friday, nothing else changes" is a message you can approve from your phone in half a minute.
What it looks like in practice: Google, Meta and WordPress
The practical point to understand: an approval policy isn't enough without enforcement. If the permission in the system allows publishing, "the agent promised not to publish" is trust, not security. The platforms themselves provide tools, and it's worth using them. We checked what's documented on the official sites:
| System | What the permissions allow | What it means for an agent |
|---|---|---|
| WordPress | The Contributor role can write and manage their own posts, but not publish them. An Editor can already publish. | An agent that prepares content can get a role that prevents it from publishing. Publishing stays yours alone. |
| WordPress | An Application Password is meant for software, not human login, and each one can be revoked separately. | A dedicated key for the agent, which you shut off without changing your own password. |
| Google Ads | Access levels: email only, billing, read only, standard and admin. Read only can see campaigns and billing details. Standard can already edit campaigns. Admin can also grant access and change levels. | You can start with read only, and the agent will prepare reports and suggestions. |
| Meta | You can give a partner full control of an asset, or partial access only for selected tasks, such as creating content, managing ads and replying to messages. | Partial access to the tasks that are needed, not full control. |
| OpenAI API | You can set a monthly cap per project, and once it's reached, requests return an error. Spend alerts are only notifications. | A real cap is not a reminder. |
A note on Google Ads: at the "standard" level the agent can already edit campaigns, so we don't rely on the access level alone to make sure a budget change waits for approval. That rule is also set in the agent's instructions and in the approval gate on Telegram, and every such change is written to the log. And in systems where it's possible, you start with read only and widen it only when needed.
On the differences between WordPress roles and on taking a backup before a change, we wrote in the guide to managing a WordPress site with an AI agent. For the paid advertising side, and for the definition of "what the agent does and what you approve" in campaigns, there's a separate article: managing campaigns with AI.
How far can spending run away? The numbers worth knowing
A daily budget is not a perfect safety tool, and you should know the numbers before you rely on it. According to Google Ads Help, on any given day a campaign can spend up to twice the average daily budget, and by the end of the month the average should match the budget. The monthly ceiling is calculated as the daily budget times 30.4.
Sources: Google Ads Help, About spending limits. OpenAI API Changelog, July 22, 2026, and OpenAI API Docs, Rate limits and spend.
The practical conclusion: a cap is a layer of protection, not a substitute for approval. You set it at the platform level, so even a mistake by the agent, by whoever set it up, or by an attacker can't go past it. And once the campaign is running, the person who approves a budget change is you.
Why even approval isn't enough: an instruction hidden inside content
There's another reason not to count on the agent "figuring it out on its own." An agent reads things you didn't write: emails, websites and files. If a hidden instruction sits inside them, like "send the customer list to this address," a language model can confuse content with instruction. OWASP ranks this as the number one risk on its list (LLM01), and writes that it's unclear whether it can be fully prevented. This is where narrow permissions do the work: a hidden instruction can't open a door that the key doesn't open. We told the full story in the guide to Prompt Injection.
Four tools that save you when something goes wrong
Permissions and approvals prevent problems. But employees make mistakes, and so do agents, so you need to be ready for the day something happens:
- A log. Every significant action is recorded: what, when, in which system and with which permission. Without a log, "what happened here?" turns into guesswork.
- A backup before a change. Before a significant change to the site there's a backup, and someone has already checked once that you can restore from it.
- A way back. Every change is built so it can be reversed: a previous version, a draft instead of a publication, an update in a test environment.
- Cutting off access in a minute. You know exactly where each of the agent's keys is, and how to revoke it. Whoever set up the agent should show you that list.
On the last tool, check for yourself: ask whoever set it up to show you, system by system, where the agent's access is revoked. If the answer is "we'll change everyone's password," that's a sign a dedicated identity is missing.
Quick check: how secure is your setup?
Tick what's true for your agent, or for the agent you're thinking of connecting. Every tick is a reason to ask whoever is setting it up, not a score.
Is the agent's setup safe?
Five myths about AI agent security
Myth"If the agent is smart enough, it will work out what not to do"
In practiceIntelligence doesn't replace restriction. OWASP recommends limiting tools and permissions up front, rather than trusting the model to decide on its own.
Myth"An instruction in the prompt saying 'don't publish without approval' is enough"
In practiceAn instruction is one layer, and it isn't as strong as a permission. When the system itself doesn't allow publishing, there's nothing to get around.
Myth"The agent will be very careful, so you can give it full access"
In practiceFull access is exactly what turns a small mistake into an expensive one. You start narrow and widen as you gain experience.
Myth"Asking for approval on everything will make it unusable"
In practiceOnly orange actions wait. Green runs on its own, and during the trial period you can tighten the rules and then relax them, as OpenAI's guide also suggests: human oversight at the start, and less as trust grows.
Myth"This is a problem for big companies"
In practiceIt's precisely in a small business, where the credit card, the website and the advertising sit in the same account, that one mistake reaches everywhere fast. And in Israel there's also Amendment 13 to the Privacy Protection Law. Readers elsewhere should check their local privacy rules.
What we do differently
A personal opinion, from 12 years in digital: most of the damage in small businesses doesn't come from a sophisticated attack but from access that's too broad. So in every setup we start with the list of what the agent will not get, and only then add permissions by task. A separate server for every business, a dedicated identity in every system, and progress from reading to writing. And if a permission being requested is broader than what's needed, we stop and present the risk and the alternative.
What we won't do: we won't ask for your personal password, we won't store secrets in plain text, and we won't start with full automation "because it's impressive." The power of an agent is that it does a lot. The responsibility is that what it isn't supposed to do, it can't do.
On the seven layers of a complete agent, from the server to the log, we wrote in the guide to building an AI agent. On connecting the agent to Telegram as your approval channel: an AI agent on Telegram. And if you're just getting started, the main guide is an AI agent for business.
Frequently asked questions
What is AI agent security?
AI agent security is the set of settings that limits what the agent can do in the business's systems: a dedicated identity in every system, minimum permissions, human approval for actions that cost money or get published, spending caps, an action log and a backup. The goal is that even if the agent makes a mistake, or someone tries to trick it, the damage is limited.
Can an AI agent spend money without my approval?
Only if you gave it a payment method or permission to change budgets. In a safe setup it isn't connected to a credit card, budget changes and campaign launches wait for your approval, and there's a spending cap at the platform level. Such a cap is only a safety net, and approval is the main protection.
Which permissions should I give the agent on day one?
The minimum needed for the first tasks: usually read access and the ability to prepare drafts. Write and publish access are added only after a trial period, and only in the systems where they're truly needed. A dedicated user for each system, not your personal password.
What's the difference between a spend alert and a cap?
An alert only tells you that you've reached an amount. A hard cap stops usage. In the OpenAI API, according to the documentation, spend alerts are notifications only, and a hard monthly cap makes requests return a 429 error. In Google Ads, the daily budget can be used up to twice over on a given day.
How do I cut off the agent's access quickly?
If every system has a dedicated identity or key, you revoke them: for example, delete the agent's Application Password in WordPress, or remove its access in Google Ads and Meta. Ask whoever set up the agent for an organized list of all the keys and where to revoke them, before anything happens.
Which models and tools does Platin Digital build agents with?
Platin Digital is an OpenAI Select Partner, and we build agents for businesses with whichever models and tools fit each business best, from OpenAI, Anthropic, Google and others, with minimum permissions and your approval for every sensitive action.
Sources
- https://genai.owasp.org/llmrisk/llm062025-excessive-agency/
- https://genai.owasp.org/llmrisk/llm01-prompt-injection/
- https://cdn.openai.com/business-guides-and-resources/a-practical-guide-to-building-agents.pdf
- https://developers.openai.com/api/docs/guides/agents/guardrails-approvals
- https://developers.openai.com/api/docs/guides/terraform/rate-limits-and-spend
- https://developers.openai.com/api/docs/changelog
- https://support.google.com/google-ads/answer/9978556
- https://support.google.com/google-ads/answer/10486637
- https://www.facebook.com/business/help/1717412048538897
- https://www.facebook.com/business/help/2169003770027706
- https://wordpress.org/documentation/article/roles-and-capabilities/
- https://make.wordpress.org/core/2020/11/05/application-passwords-integration-guide/
