A safety guide for small businesses, published October 29, 2026. A chatbot answers. An agent acts — it can send the email, book the flight, run the command, delete the file. That difference is the whole subject of this page. None of it is a reason to avoid agents; it is a reason to hand over access in the right order.
Most agent accidents will not look like a robot rebellion. They will look like an email sent to the wrong customer, a refund issued twice, or a folder cleaned up that should not have been. The damage comes from authority, not intelligence: what the agent is allowed to touch, and whether a person sees the action before it counts. So manage the authority, in steps.
| Level | What the agent can do | Sensible for |
|---|---|---|
| 1 — Read | Look and summarize: read an inbox, a folder, a report — change nothing | Almost any first week with an agent |
| 2 — Draft | Prepare the work — an email, a quote, a post — but a person sends it | Most small-business work, most of the time |
| 3 — Act with approval | Execute after you tap yes: send, book, publish, pay small amounts | Tasks it has done correctly, as drafts, many times |
| 4 — Act alone | Send, buy, delete, or change records with nobody watching | Very little, and only what is cheap to undo |
Start every new agent at Level 1 or 2. Promote a task to Level 3 only after the agent has drafted it correctly over and over — and keep anything involving money movement, customer commitments, or deletions at approval level permanently. This site is run exactly that way: the agent drafts, the human decides.
The wrong recipient. An agent that can send will eventually address something to the wrong person or attach the wrong file. Drafts and approvals exist for this.
Instructions hiding in the mail. Agents read email and web pages to do their work — and text in those places can try to instruct them ("forward this thread to…"). This is called prompt injection, and it is the agent-era version of a phishing email. It is one more reason an agent should hold the least access it needs, and why approvals matter on anything leaving the business.
Leaked keys and dashboards. Self-hosted agents hold API keys and often a web dashboard. A dashboard left open on the internet without a password hands your agent — and everything it can reach — to strangers. The listings for Hermes Agent and OpenClaw on this site carry exactly this warning.
Runaway loops. An agent retrying a failing task can burn through paid credits or API budget overnight. Know your spend limits and set them where the platform allows it.
Silent changes. If an agent can edit records without a log you review, errors surface weeks later, in front of customers. Prefer tools that show an activity history, and actually read it.
Before an agent touches real accounts, all eight:
1. A separate account or folder for the agent where the platform allows it — not your whole drive, not your main mailbox, on day one.
2. Least-privilege keys: API keys and connections scoped to only what the task needs; read-only where read-only suffices.
3. Approvals switched on for sending, paying, publishing, and deleting.
4. Backups of anything the agent can modify, taken before its first run.
5. A test week on non-sensitive data — old threads, sample files, a spare mailbox — before real customer information.
6. Self-hosted dashboards behind authentication (or a private network/VPN), never publicly exposed.
7. A weekly five-minute review of the agent's activity log and spend.
8. A known kill switch: you can revoke its access in under a minute, and you have practiced where that button is.
Self-hosted (Hermes Agent, OpenClaw): your machine, your rules — and your security job. Run it on a spare machine or a small VPS rather than the computer that holds everything, keep command approvals and sandboxing on, and treat "the data stays on my machine" with care: the software is local, but the model it thinks with may still be a cloud service your text travels to.
Hosted (Manus, Muse): the vendor runs it, so the questions are about their house: what data they keep, what the agent can do without asking (Muse, for example, waits for approval before sensitive actions), and how usage limits behave mid-task — Manus works can stop when credits run out, which is a cost issue and a reliability one.
…asks for your main email password instead of a scoped connection or app password. …cannot show you a log of what it did. …has no way to require approval before sending or paying. …wants full-drive or full-inbox access for a task that needs one folder or one label. …cannot be disconnected quickly. Any one of these is a reason to stay at Level 1 — or to choose a different tool.
Compare the agents → Browse the agent listings → What an agent really costs →