The first question every small-business owner asks about a new AI tool is "What can it do for me?" The second question — if it gets asked at all — is "What does it get access to?"

That second question matters more than the first. An AI agent that drafts your marketing copy is harmless. The same agent with a live connection to your customer database, your accounting system, and your inbox is a different creature entirely. The capability is the same; the risk profile is not.

The challenge is that most AI vendors describe their data handling in terms designed for enterprise procurement teams — SOC 2, GDPR compliance regions, encryption-at-rest. Those matter, but they don't answer the practical question a five-person business actually needs answered: should I hand this tool access to my stuff?

Jake Stauch, CEO of Serval, recently discussed this tension on the No Priors podcast. His observation was straightforward: businesses are delegating work to agents they wouldn't trust with a key to the office, because the setup flow makes connection feel like a trivial step. It isn't. Here is a five-question checklist that translates the enterprise conversation into the terms a small business can actually use.

Question 1: What data categories does this agent actually touch?

Don't accept the vendor's category. Make your own list.

Write down the specific data the agent will read, write, or influence: customer names and emails, invoice amounts, appointment schedules, employee records, inventory levels, payment tokens. Be granular. "It connects to QuickBooks" is not an answer. "It reads invoice totals and can draft payment reminders" is.

The reason for granularity: an agent that only reads your marketing analytics poses a different risk than one that can draft and send emails to customers from your connected account. Same tool, different scope. Know which scope you're authorizing.

Question 2: Are there compliance constraints on any of that data?

If you handle health information, financial records for clients, legal documents, or children's data, your compliance obligations travel with the data. An AI tool that is "HIPAA-aware" in marketing copy may not be HIPAA-compliant in your specific workflow.

The practical check: does the vendor sign a Business Associate Agreement (BAA) for health data? Do they publish a GDPR data-processing agreement you can execute? If the answer is "contact sales," that's a no until it becomes a yes. Don't assume compliance flows from a checkmark on a pricing page.

Question 3: What's the revocation path?

This is the question almost nobody asks until they need it urgently.

If you disconnect the tool tomorrow, what stays behind? Does it retain copies of your data in its training pipeline? Does it keep cached copies of documents it processed? Can you delete your account and receive confirmation that your data is removed, or does deletion just stop the billing?

A good revocation path has three parts: disconnect (stop the live flow), delete (remove stored copies), and confirm (get evidence it happened). If the vendor can't describe all three, you are not renting the tool; you are gifting it a copy of your data with no return policy.

Question 4: Has the agent been tested on non-sensitive drafts first?

There is a correct order of operations for connecting any new AI agent: test with fake data, then test with old real data, then test with live data — and only if the first two phases pass cleanly.

The fake-data phase means running the agent on a sandbox account with 20 synthetic records that look like your real data but contain no real customer information. The old-data phase means running it on last quarter's exported records where the outcomes are already known. If the agent miscategorizes a known invoice or drafts an embarrassing email to a fake customer, you want that failure in a test environment, not in front of a real client.

Most failures are obvious in the first five minutes of sandbox use. Most businesses skip the sandbox and discover the failures in production.

Question 5: What's the audit trail?

When an agent takes an action — sends an email, updates a record, categorizes an expense — can you see what it did, when it did it, and what input it acted on?

An audit trail is not a feature for paranoid people. It is how you answer a customer's question, reverse a mistake, and spot a pattern before it becomes a habit. If the agent's interface shows you a summary of its work but not the individual actions, you don't have an audit trail. You have a status update.

Ask the vendor: can I export a log of every action this agent took in my account, with timestamps? If the answer is no, the agent is operating in a black box. That may be acceptable for low-stakes tasks. It is not acceptable for anything touching money, customers, or commitments.

What "yes" looks like

You don't need perfect answers to all five questions. What you need is to know which questions the tool fails, and decide whether that failure matters for the job you're hiring it to do.

An AI tool that drafts blog posts and fails the compliance check is probably fine — blog posts aren't regulated data. The same tool connected to your customer support inbox and failing the audit-trail check is a problem, because you need to know what it told your customers.

The honest frame: data handover is not a trust exercise. It is a risk-matching exercise. Match the tool's access to the stakes of the job, keep a sandbox between the agent and your live systems, and never skip the revocation question just because the setup flow makes connection feel free.

Ready to build safer AI habits in your business? The Boring Automation Pack includes step-by-step guides for sandboxing, testing, and rolling out AI tools without the surprises.