Sixty-six percent of small businesses now use AI, and the U.S. Chamber of Commerce’s 2026 report puts agentic tools, which work without direct user guidance, at 24 percent. In our experience, in a business with no identity team that agent is almost always signed in as the owner, and that one fact decides more about your security than any policy you could write.
The agent arrived before anyone decided what it could touch
The U.S. Chamber of Commerce’s 2026 Empowering Small Business report, published October 2, 2026, puts small-business AI use at 66 percent, up 8 points from 2025 and nearly three times the 23 percent recorded in 2023. The full report, built on a Teneo Research survey of 3,732 U.S. businesses with fewer than 250 employees, fielded from July 23 to August 6, 2026, lists the AI tools in use: generative AI chatbots lead at 41 percent, followed by predictive tools at 27 percent, coding tools at 26 percent, and agentic AI tools at 24 percent — defined in the report as tools that automate processes or perform tasks “without direct user guidance.” The report also lists agentic tools among the newer technologies small businesses plan to adopt, cited by 34 percent.
Two more figures explain how those agents get set up. The report finds that 64 percent either mostly or entirely rely on externally developed AI tools, and that about 41 percent use free ones. Nobody built these agents; they were connected. Connecting an agent to a business means giving it accounts — the mailbox, the calendar, the accounting platform, the customer list — through whatever login the person doing the setup has to hand. In a company of twelve people, that person is the owner, and the login is the owner’s.
The report also forecloses the easy answer. Seventy-eight percent of AI users say limiting their access would slow growth, and 75 percent say it would hurt their bottom line. The control cannot be “turn it off.” It has to be “narrow what it holds.”
Without an identity team, the agent inherits the owner
In our experience the setup follows the same pattern across trades, clinics, agencies, and shops. The owner installs an agent to triage email, chase invoices, or book appointments. The fastest route is to sign the agent in with the owner’s Google or Microsoft account, approve every permission the connection screen asks for, and link the bank or accounting platform the same way. Nothing about this is reckless by the standards of the tools; it is the default path. The result is an agent that holds everything the owner holds: the ability to read any email, send as the owner, see every customer record, and in many setups move money.
That matters because an agent acts on what it reads. An inbound email, a web page, or a shared document can carry instructions, and an agent with owner-level access that follows them has owner-level consequences. The National Institute of Standards and Technology (NIST) framed the problem in February 2026: giving AI agents access to data, tools, and applications requires “appropriate identification and authorization controls to mitigate these risks,” and its National Cybersecurity Center of Excellence proposed a project to show that “identity standards and best practices can be applied to software agents.” The concept paper behind that project lists the questions an enterprise identity team would be expected to answer: how to “distinguish between agent and human identities,” how to “Link specific user identities to AI agents or software systems,” how to handle delegation of authority when an agent acts on someone’s behalf, how to “create, update and revoke agent identities across systems,” and how to establish “least privilege” for an agent.
A small business has no one whose job it is to answer those questions, and the concept paper was open for comment only through April 2, 2026 — it is a research agenda, not a standard. The owner has to answer them with the settings the tools already provide.
An agent signed in as the owner can do everything the owner can do, for anyone who learns how to ask it.
An agent signed in as the owner can do everything the owner can do, for anyone who learns how to ask it.
Borrow the token standard NIST wrote for federal agencies
The standard worth borrowing already exists, even though it was not written for you. In September 2026 NIST and the Cybersecurity and Infrastructure Security Agency (CISA) finalized Interagency Report 8587, Protecting Tokens and Assertions from Forgery, Theft, and Misuse, implementation guidance for agencies and cloud providers on the access tokens that sit behind every “connect your account” button. Its core rules translate directly. Scopes “enable least privilege by providing a limited set of actions or authorizations,” so a token should permit only the actions the task needs. Access and identity tokens should be valid for no more than one hour, with shorter lives for higher-risk resources. “Workloads need to be uniquely identified and managed,” and short-lived tokens are preferred over static secrets for non-human identities. Tokens that are compromised, lost, or no longer needed should be revoked.
The report treats AI agents as largely outside its scope, but states that its guidelines apply “when agents use signed tokens” to reach systems, data, tools, or APIs — which is how the agents in your business reach your mailbox and your books. The Cloud Security Alliance’s research note on the final guidance, published September 23, 2026, draws the practical conclusion: agents use the same token mechanisms the report covers, and organizations should apply its token, key, and sender-binding controls to agent tokens now rather than wait for agent-specific guidance.
The owner’s version takes an afternoon and four decisions
Translated out of federal language, least privilege for a small-business agent is four decisions the owner can make before the next renewal invoice arrives.
- Give each agent its own identity. Create a separate account for the agent in your email and productivity suite — a named user or service account, not the owner’s login. If an agent misbehaves, you disable one account and the owner keeps working.
- Connect per system, at the narrowest scope the platform offers. Read-only on the calendar if it only books; draft-but-not-send on email until you have watched it for a month; view-only in accounting with no payment permission. Approve the permission screen line by line instead of accepting the bundle.
- Put an expiry on every connection. Where the platform lets you set token or session lifetimes, set them short, in the spirit of the one-hour ceiling NIST recommends; where it does not, calendar a review of each agent’s connections every quarter and re-approve them deliberately.
- Know where the revoke button is before you need it. Every suite has a page listing connected apps and their permissions. Find it, bookmark it, and confirm that removing the agent’s access there actually stops it.
Only after those four are in place does a written rule earn its keep, because the rule will then describe access that exists rather than access you hope the agent is not using. The inventory question — which agents and tools are in the business at all — comes first and is a separate exercise; the scope question is what to do about each one you find.
Policies describe intent; permissions describe reality, and an agent only ever acts on the second. Give it its own keys, cut them to the task, make them expire, and know how to take them back — then write the policy, which will finally have something true to say.