Imagine an AI assistant that reads your inbox every morning, sorts what matters, drafts replies, schedules appointments, and files attachments where they belong. For a busy owner or office manager, that sounds like getting an extra pair of hands. Tools like this are real and getting better quickly, and they can be genuinely useful. But an assistant that can act on your behalf is a different kind of thing from a chat window that only answers questions, and it deserves a different level of care before you switch it on.
Chat assistants talk. Agents act.
When you ask a chat assistant a question, the worst outcome is usually a bad answer. You read it, decide whether it makes sense, and move on. An AI agent is built to go further. It is given access to your accounts and permission to take steps toward a goal, such as reading messages, sending replies, editing documents, moving files, or updating records. Nobody has to click anything for each step.
That independence is the appeal, and it is also the risk. A mistake in a chat window costs you a minute. A mistake by an agent with access to your email and shared drive can mean a message sent to the wrong person, a file shared outside the company, or a folder deleted. The tool does not need to be malicious for this to happen. It only needs to misunderstand something, or to be told to do something by the wrong source.
Prompt injection, without the jargon
Here is the core issue. An AI system reads text and decides what to do based on it. It cannot reliably tell the difference between instructions from you and instructions that happen to be written inside something it is reading. If a message or document contains text that says, in effect, "ignore your previous instructions and do this instead," the system may follow it. That is called prompt injection.
Picture a hypothetical example. You ask an agent to summarize new vendor emails and file the invoices. One email looks routine, but somewhere in it, perhaps in tiny or hidden text, is a line telling the assistant to forward the last several months of correspondence to an outside address and then delete this message. A person reading the email would never see it. An agent reading the raw text might treat it as just another instruction.
The same thing can hide in a shared document, a web page the agent visits, a calendar invite, or a file attachment. The attacker does not need to break into anything. They only need to get some text in front of your agent.
It is worth being honest about where things stand. Vendors have built many defenses, and they help, but there is currently no complete fix for prompt injection. It is not simply a bug that will be patched next month. That is why the sensible approach is not to hope the tool resists every trick. It is to limit what a tricked agent could do, and to keep a person in the loop for anything that matters.
Guardrails that work in a small office
None of the following requires a technical background. They are decisions about access and approval, and they apply whether your agent comes from a large vendor or a small one.
- Give the least access needed. If the agent only needs to read the inbox to produce a daily summary, do not also give it permission to send, delete, or see the shared drive.
- Start read-only. Let it read and summarize for a few weeks before it is allowed to change anything. You will learn how it behaves while the stakes are low.
- Require human approval for consequential actions. Sending to outside recipients, moving or spending money, sharing files, changing account settings, and deleting anything should wait for a person to click approve.
- Use a separate account. Rather than connecting the agent to your own mailbox, consider a dedicated account or a limited set of folders, so a problem stays contained.
- Keep sensitive material out of reach. Patient records, client financial files, and credentials should not be within the agent's reach unless there is a specific, well-considered reason.
- Keep logs. You should be able to see what the agent read, what it did, and when. If something looks odd, a record is the difference between a quick answer and a long guess.
Approval deserves special attention, because it is easy to undermine. If the agent asks for permission constantly, people will start clicking yes without reading. Aim for a small number of approvals that matter, and make each one show clearly what is about to happen: who the message is going to, what it says, and what is attached.
Test before you roll it out
Before an agent touches real client information, try it on a realistic copy of your work. Set up a test mailbox with sample messages and see how it behaves. Include a few awkward cases on purpose: an email with odd instructions in it, a document that asks the reader to do something unexpected, a message from an unfamiliar sender that looks urgent. You are not trying to catch the tool out for sport. You are finding out what it does when the input is not friendly, because sooner or later some of it will not be.
Then roll out in stages. Begin with one person or one task, watch the logs, and widen access only when you are comfortable. Decide ahead of time how you would switch the agent off quickly, and who has the authority to do it.
What to ask a vendor
A good vendor will not be bothered by careful questions, and the quality of the answers tells you a lot. Plain, specific replies are a good sign. Vague reassurance is not.
- What exactly can the agent read, send, change, and delete, and can we narrow that?
- Can we require a person to approve specific actions before they happen?
- What happens to our data? Is it stored, for how long, and is it used to train models?
- How does the product handle instructions hidden in emails, documents, and web pages?
- Can we see a log of what the agent did, and export it?
- How do we turn it off, and what happens to its access afterward?
A measured way forward
Agents are a sensible thing for a small business to explore. The time savings on routine inbox work can be significant. The approach that works is the same one you would use with a new employee: limited access at first, supervision on anything important, and more trust as they prove themselves. Treat the agent as capable but new, and it is likely to serve you well.
If you are weighing an AI agent for your practice or firm, Cyberintell can help. We review how an agent would be set up, suggest sensible limits and approval steps, and test how it responds to the kind of hidden instructions described here. You can start with a conversation about what you have in mind.
