Should a Small Business AI Policy Allow AI Agents?

The rule one client chose last week

Last Wednesday we met with a client to finish their AI policy. We brought a list of every app staff had connected to their Microsoft 365 accounts, including several AI note-takers. They landed on a short rule: chatbots from known sources only.

That put AI agents out. An agent tool someone wanted connected to a mailbox was set aside, and so was a coding agent. The next day we looked at a brand new AI agent app for them. Same answer. In its current preview it runs on personal accounts only, with no admin controls and no audit logs a business could review.

That same day we turned off the Microsoft 365 setting that let staff connect apps to their work accounts on their own. Now a new connection needs an admin's approval first, so the policy and the settings agree.

Chatbot or agent: what is the difference?

A chatbot waits for you. You type a question or paste in a draft, it answers, and a person decides what to do with that answer. ChatGPT, Copilot and Claude all work this way in their regular chat windows.

An agent takes steps on its own. It might read your inbox, send email, fill in web forms or click through websites, sometimes while your computer is off. Some ask before they send or pay. Some remember what they learned even after you disconnect them. That can save real time, but it also hands a lot of access to software nobody in your office has checked.

Why we would start with chatbots only

First, you can see what happened. With a chatbot, a person reads every answer before it goes anywhere. An agent works out of sight, and on a personal account there may be no log anyone at the company can check.

Second, the source matters. A chatbot from a known company on a business plan comes with admin settings and terms you can read. In this client's list, the apps we worried about most could read and send email, and a few came from publishers Microsoft had not verified.

Third, it is easy to remember. Staff will remember one sentence much longer than they will remember a three-page document. A good AI policy for small business can start with a single clear line and add detail as questions come up.

Back the policy with a setting

A written rule helps, and a setting helps more. Microsoft 365 has an option that controls whether staff can let an app read their mail, calendar and files without asking anyone. If nobody has changed it, your staff may be able to approve those apps on their own. When you turn it off, new apps need an admin's approval first. We cover this kind of setup in our Microsoft 365 services.

Before you change it, two things are worth knowing. First, look at what is already connected. Turning the setting off blocks new connections, but apps that already have access keep it, so remove the ones you no longer want. Second, plan for requests. The same afternoon we made the change, a security training tool staff already used needed an admin to approve it, and we did. It also helps to give staff an easy way to ask for an app, and we are finishing that step with this client now.

Leave a door open

Chatbots only is where to start, and it can change later. These things would change our answer on an agent: a business version with admin controls, activity logs the company can see, and a way to limit what the agent can touch. Until an agent has those, the answer is not yet.

Some of the jobs people want an agent for can be done another way. For meeting notes, we suggested this client choose one approved note-taker instead of letting several pile up. Sometimes a small tool built for one job inside your own Microsoft 365 does the work with less access. We build tools like that and help offices plan them through AI consulting.

What to do this week

Decide where your line is. Write one sentence that says which AI tools are allowed and on which accounts. Chatbots from known companies, on business accounts, is a sensible place to start.

Then look at what is already connected to your company email, and check the Microsoft 365 setting that lets staff approve apps on their own. If you want help with either one, or want your team trained to use the approved tools well, our AI training in Spokane covers both. We work with offices across Spokane, Spokane Valley, Liberty Lake, Coeur d'Alene and Post Falls.

Quick answers

Does a chatbots-only AI policy mean staff cannot use AI? No. Staff can still use ChatGPT, Copilot or Claude to draft, summarize and think through problems. The rule only limits tools that act on their own.

How do I see which apps are connected to our Microsoft 365? An admin can check Enterprise applications in the Microsoft Entra admin center. It lists connected apps and the permissions they were given. We can also pull the list for you.

Will turning off user consent break anything? It can cause some friction at first. An app staff haven't approved yet will need an admin to approve it. When we made this change for a client, one training tool needed approval the same day. Expect a few requests in the first week.

Keep reading

• Is Your Email Inbox the Master Key to Your Business? We reviewed our own setup this week and found one inbox held the keys to nearly everything. Here is how to check yours, especially once AI is connected.
• Which AI Note-Taker Should a Small Office Use? We found two AI note-takers at one client. Here is why we recommend picking one, and what we suggest for Microsoft 365 offices.
• The Six Numbers Every Business Owner Should Check Every Morning Cash, unpaid invoices, backups, patching, sign-ins and missed calls: where each one lives, and how to see them on one page.
• How Much Do Managed IT Services Cost in Spokane? (2026) Real numbers: $50 to $150 per computer per month, what moves the price, and what to ask before you sign.
• Should You Let ChatGPT Read Your Business Website? Many small business websites quietly block AI crawlers. Here is what that costs you, and how to decide.
• What Is DMARC, and Does Your Small Business Need It? One small DNS record decides whether a scammer can send email that looks like it came from you.
• All articles and guides