What to check before connecting AI agents to business systems
AI agent security for business starts with a simple question: what information can the agent see, and what can it do with it. An AI agent connected to a CRM, Google Sheets, or WhatsApp can access sensitive information, send messages on behalf of the organisation, and perform actions that affect customers and internal processes.
This checklist is built on work with production systems under banking security standards and experience building AI agents in regulated environments. It focuses on checks you can perform before activating the agent, and control mechanisms that allow you to identify problems early.
Permissions: what the agent can do
Every agent needs explicitly defined permissions. If it connects to Google Sheets, can it only read or also write? If it connects to HubSpot, can it update customer records or only read them?
In n8n, every connection to an external system goes through a Credential that defines the access level. Correct configuration means an agent that needs to read customer data does not receive access to update or delete. Incorrect configuration means an agent can change information it should not touch.
Check:
- Does the agent receive access only to information it needs to perform its task
- Are permissions defined at the external system level (API token, OAuth scope) and not just at the workflow level
- Is there a way to revoke access in an emergency without breaking other processes
In banking systems, permissions follow the principle of least privilege: the agent receives the minimum required, and no more. This applies to smaller businesses as well.
Monitoring: who did what and when
An AI agent performing actions on behalf of the organisation needs to leave traces. If a customer receives a WhatsApp message, it should be clear it was sent by automation and not by an employee. If a CRM field changed, you need to know which workflow did it.
In n8n, every workflow execution is saved in an execution log with timestamp, input data, and output data. This allows you to go back and see exactly what happened. But this log is not enough if it is not checked.
Build:
- Alerts on unusual actions: high number of requests, repeated errors, or attempted access to information that should not be accessible
- Built-in logging of every action that changes information: update in Sheets, send in WhatsApp, create card in Monday
- Ability to filter logs by agent, by system, or by action type
Good monitoring does not just help identify problems. It also allows you to answer questions from customers or auditors.
What happens when the agent makes a mistake
AI agents are not perfect. A model processing customer requests can misunderstand a request, send an irrelevant response, or attempt to perform an unintended action. The question is not whether this will happen, but what happens after it does.
In production systems, every critical action goes through a control layer. If an agent wants to update a price in a quote, it does not do it directly. It sends the update for review, or performs it only if it is within a predefined range.
Ask:
- Are there actions the agent cannot perform at all, even if the model decides they are correct
- Do high-impact actions require human approval
- Is there a mechanism to stop the agent if it behaves unexpectedly
In the case of Claude, which performed unplanned actions during testing, the problem was not just the model’s behaviour. The problem was insufficient stopping mechanisms. You can read about it in the documentation of the incident.
Where information is stored
Every AI agent processing business information stores it somewhere. The question is where, and for how long.
If the agent uses the OpenAI or Anthropic API, data passes through their servers. Most providers offer options where data is not saved for model training, but you need to enable this explicitly.
If the agent is built on n8n, data passes through the environment where n8n runs. If it is self-hosted, information stays on the organisation’s servers. If it is n8n Cloud, information passes through n8n’s infrastructure.
Check:
- Do API providers commit not to store the information or use it for training
- Is information encrypted in transit and at rest
- Is there a clear policy for deleting data after a defined period
In regulated environments, such as banking or healthcare, there are legal requirements about where information can be stored. Even businesses not subject to such regulation should know where their data is.
Testing before activation
Before activating an AI agent in production, test it in an isolated environment with non-sensitive data.
Good testing includes:
- Running typical scenarios: standard customer requests, routine updates, information queries
- Running extreme scenarios: invalid input, unclear requests, attempted access to information that should not be accessible
- Testing stopping mechanisms: do alerts work, does the agent stop when it should, can actions be cancelled
In banking systems, such testing is part of standard development process. In smaller businesses, it does not always happen. But even simple automation can cause damage if not tested.
Summary: security is not an add-on
AI agent security for business is not something you add after the agent is already working. It is part of the planning from the start: what information the agent needs, what it can do with it, how you monitor it, and what happens when it makes a mistake.
A simple checklist can prevent serious problems. Correctly defined permissions, working monitoring, stopping mechanisms, and testing before activation. It is not complex, but it requires attention.
Want to know which automation is right for your business? A free 30-minute diagnostic call, no commitment, we'll map out your processes together and honestly tell you if and how automation can help.