Do this: Before any AI tool is allowed to spend money or send messages for you, write its permission slip. Two minutes, and it is the cheapest control in your business.
PASTE THIS
Write a one page permission slip for an AI tool in a small business. Ask what the tool does, then give a table with four columns: what it may read, what it may send, what it may spend, what it must never do. For anything touching money, messages or customer records, name who approves it and where the log lives. Finish with the three limits to set before switching it on.
You'll get: A one page list of limits you can hand to whoever sets the tool up: a spend ceiling, an approval name, a place to check what it did. Keep it with your insurance and your lease. When something goes wrong, this page says what was supposed to happen.
Six questions to send any supplier that holds your data
Send this to the three suppliers who hold the most about your business: payroll, your booking system, and whoever hosts your email. Same six questions, one email. A supplier who cannot answer in writing has answered.
Most businesses run two sets of permissions. One is written down and signed. The other arrived switched on: a supplier holding your customer list, an agent holding your card, a plugin nobody remembers installing. The second set is where the trouble lives, and it costs nothing to fix. Name what each system may do, and who approves the exceptions.
The owner of Phase Eight and Hobbs has been hit by a cyber-attack, and H&M is investigating a separate claim, the BBC reports. Meanwhile The Register finds ransomware crews turning personal, making threats against staff rather than just locking files.
So what: this week, email your three biggest software suppliers one question each, in writing: if our data is breached, who tells us and how fast? Keep the replies with your insurance file, and cut any supplier who cannot answer.
Your AI pilots are on the public internet
Censys found AI-related infrastructure exposed to the public internet jumped 63% in nine months, and shared it first with Axios. A demo someone built on a Friday, with no login, is still sitting there. So what: this month, list every AI pilot anyone in the business built and switch off the ones nobody owns anymore.
American Express is building a leash for agent spending
Amex has introduced a framework to stop AI agents making unauthorised purchases, TechCrunch reports. Every card issuer is watching the same problem: software that can buy things faster than you can check. So what: this week, ask your card provider for a per-transaction cap on any card an AI tool can reach, and get the answer in writing.
Meta is selling agents to businesses your size
Meta has expanded its Muse agent to small businesses, AI Business reports, pushing autonomous tools into operations that have no compliance team. The promise is real, and so is the oversight gap. So what: before your next renewal, run it on one recurring task with a human approving anything that leaves the building.
This week's question: if an AI tool books, buys or emails on our behalf, who is responsible when it gets it wrong? You are, and the contract will say so. Software does not sign anything, so the liability lands on the business that switched it on. The practical answer is to make the responsibility visible before it is tested: one named person owns each tool, one written limit on what it may do, and one place the actions land so somebody can read them. Ask your insurer whether your policy covers an action taken by software you authorised. That question is cheaper now than after an incident.
Which of these can spend your money without asking you first?
A. An AI tool with a card on file
B. A supplier we pay automatically
C. A staff member with no limit set
D. None of them, every payment is checked
Reply with one letter — results next issue.
GlobalFoundries plans two new chip plants in New York, backed mostly by one government. Which country is putting up the money, and what stake does the United States take?
Answer tomorrow — and no, we are not printing it here.
YESTERDAY'S ANSWER
Anthropic warned this week that small AI models could soon copy themselves onto everyday devices. Which kind of device did its researchers single out?
Off-brand Android TV boxes. Anthropic's Frontier Red Team paper names commercial IoT devices such as smart ovens and off-brand Android TV boxes, and the demonstration ran across 15 off-brand Android TV boxes at roughly $55 each.
About 5 minutes to read. One thing you can use today every issue.
Setups like today's 2-Minute Win can be installed for businesses like yours — reply SETUP and we'll send what's involved.
Know an owner drowning in their inbox? Forward this — the 2-Minute Win is worth 2 minutes.
Forwarded this? Subscribe here
Sent by AI for Everyday Business.
8735 Dunwoody Place STE R, Atlanta, GA 30350