Blog · October 31, 2026

AI Agent Policy for Small Business: What to Include and How to Roll It Out

An AI agent policy for a small business is a short, written set of rules that says which AI agents your team may use, what those agents are allowed to touch, who approves new ones, and what happens when one acts without permission. It goes one step further than a general AI use policy, because agents don’t just answer questions. They click, type, open files and send things on your behalf.

This guide walks through the ten parts every small-business agent policy needs, gives you copy-ready wording for each, and shows how to roll it out and check your Windows 11 PCs without an IT department.

What an AI agent policy covers (and how it differs from an AI use policy)

Most small businesses that have written anything about AI have an AI acceptable use policy. It usually covers chat tools: don’t paste client data into a chatbot, check its answers, and say when you used AI in your work.

An AI agent policy covers software that takes actions. If you’re not sure where that line is, our plain-English guide to what an AI agent on your computer is explains it with examples. In short, an agent can do things like:

open apps and websites and work through them on its own
read, move or edit files on the PC
send email or messages from accounts you connected
install browser extensions or connect to other online services
keep running in the background after you’ve moved on

Those abilities are useful. They’re also why an agent needs its own rules. A chatbot that gives a bad answer wastes a few minutes. An agent that follows a bad instruction can send the wrong file to the wrong client.

You don’t need two separate documents. Many small businesses add an "AI agents" section to the AI use policy they already have. What matters is that the agent rules exist, are written down, and are short enough that people actually read them.

Why small businesses need agent rules now

Three things changed in the past year.

Agents moved onto the PC. Microsoft is building agent support into Windows 11 itself. Its documentation describes an agent workspace, "a separate, contained space in Windows where you can grant agents access to your apps and files so they can complete tasks for you in the background while you continue to use your device." Copilot Actions, which Microsoft’s support page describes as a preview for Windows Insiders, uses it. Third-party agents and AI browser extensions are also easy for anyone on your team to install.

Agents can be tricked. Microsoft’s own guidance names a risk called cross-prompt injection (XPIA), "where malicious content embedded in UI elements or documents can override agent instructions." In plain terms: a web page or document an agent reads can contain hidden instructions, and the agent may follow them.

Too much access is the core problem. The OWASP Gen AI Security Project, a widely used security reference, lists "Excessive Agency" as a top risk for AI systems. It traces the problem to three causes: excessive functionality, excessive permissions and excessive autonomy. Your policy is how you limit all three.

A policy won’t stop people from wanting to use agents, and it shouldn’t. Its job is to make sure the agents in use are ones you know about, with access you chose.

The 10 parts of an AI agent policy for small business

Each part below has a short explanation and sample wording you can copy, edit and paste into your own policy. Keep the final document to one or two pages.

1. Purpose and scope

Say what the policy covers and who it applies to. Keep the definition of "AI agent" simple so non-technical staff can tell what counts.

Sample wording: This policy covers AI agents: software that uses AI to take actions on a computer or online account, such as clicking, typing, opening or changing files, or sending messages. It applies to everyone who uses a company computer or company account, including contractors.

2. The approved agents list

This is the heart of the policy. Keep a simple list, in a spreadsheet or a shared document, with one row per approved agent:

Column	Example
Agent or tool name	Name of the AI app or browser extension
What it’s approved for	Drafting replies in the support inbox
Who may use it	Front office staff
Which PCs	Front desk PC, office manager’s laptop
Accounts it may connect to	Support inbox only (read and draft)
Owner	The person who answers questions about it
Date approved / next review	October 2026 / January 2027

Sample wording: Only agents on the approved agents list may be installed or used on company computers or connected to company accounts. If an agent isn’t on the list, don’t install it, connect it or use it for company work.

3. How a new agent gets approved

People will find new tools. Give them an easy, quick way to ask, so they don’t just install it and hope.

Name one approver. In a five-person office that might be the owner; in a 25-person firm it might be the office manager or your outside IT provider. Before approving, the approver answers a few questions:

What will the agent do, and on which PCs?
What files, folders and accounts does it need? Can it work with less?
Can it send, delete, pay or install anything? If so, does it ask a person first?
Where does its data go, and does the vendor say how long it keeps it?
How do we turn it off or remove it if we need to?

Sample wording: To request a new AI agent, email [approver] with the tool’s name, what you want it to do and which accounts it needs. Don’t install it until it’s approved and added to the list. Approval or a reply will come within [5] business days.

4. Data rules: what agents must never touch

Be specific. "Be careful with sensitive data" is too vague to follow. List the categories your business actually holds.

Sample wording: AI agents must not be given access to: client files and records, payroll and HR files, bank and payment accounts, saved passwords or password managers, or any data we are required by contract or law to protect. If an agent asks for access to these, say no and tell [approver].

If your business has industry rules (for example, health, legal or financial records), have the person responsible for those rules review this section.

5. Least access: connect only what the task needs

Many agents ask for broad access because it’s convenient. Your policy should push the other way. OWASP’s guidance on excessive agency recommends limiting an agent’s tools and permissions to the minimum necessary. Its example: an agent that only needs to summarize emails should be able to read them, not delete or send them.

Two practical rules help a lot here:

Use the smallest connection that works. Read-only beats read-and-write. One mailbox beats all mailboxes. One folder beats the whole drive.
Use standard user accounts for daily work. Microsoft advises limiting the number of administrators on a Windows PC "because administrators have complete control over the system" and recommends standard user accounts for day-to-day activities.

Sample wording: Connect AI agents only to the specific folders, mailboxes and accounts listed for them on the approved list. Use read-only access whenever the task allows. Staff use standard (non-administrator) Windows accounts for daily work.

6. A person approves high-impact actions

Decide which actions an agent may never take alone. OWASP calls this "human-in-the-loop" control: a person approves high-impact actions before they happen.

Sample wording: An AI agent may prepare, but a person must review and approve before it: sends email or messages outside the company; makes or approves a payment; deletes or moves shared files; installs software or browser extensions; changes account, security or system settings; or signs up for any service.

If an agent can’t be set to ask first for these actions, it shouldn’t be connected to the accounts that allow them.

7. Windows 11 agent settings

Windows 11 now has its own agent settings, so your policy should say how they’re set on company PCs.

According to Microsoft, the Experimental agentic features setting is off by default. It can only be turned on by an administrator, and once on it applies to all users on that PC. You’ll find it under Settings > System > AI components > Experimental agentic features. When it’s on, Windows can create separate agent accounts and an agent workspace, and agents such as Copilot can request access to six folders in your profile: Documents, Downloads, Desktop, Music, Pictures and Videos. Microsoft’s support page says that to limit access to those folders, you turn the setting off.

On newer preview builds, Microsoft also describes a per-agent page under Settings > System > AI components > Agents, where the Files section offers Allow Always, Ask every time or Never allow. By default, Windows asks for consent when an agent requests those folders.

Sample wording: Experimental agentic features stay off on company PCs unless [approver] turns them on for an approved agent. Where Windows offers per-agent file settings, use "Ask every time" unless the approved list says otherwise.

Our guide to Windows 11 agentic AI and how to turn it off shows where this setting is and what changes when you switch it off.

8. Browser extensions

Many AI agents live in the browser, so extensions belong in the policy. Microsoft’s guidance for businesses suggests making a list of the extensions employees need, checking the permissions each one requests (you can see them at edge://extensions in Microsoft Edge), and reviewing the list regularly.

If your PCs are managed with Group Policy, Microsoft Edge has policies that let you allow only the extensions you approve. If they aren’t, the rule and a regular check do the job.

Sample wording: Only browser extensions on the approved list may be installed in browsers used for company work. AI extensions that can read or change web pages, or act on websites for you, need approval like any other agent.

9. Regular checks and reviews

A policy nobody checks becomes a policy nobody follows. Set a simple rhythm:

Monthly: check each PC for AI apps, startup items and extensions that aren’t on the approved list (the steps are below).
Quarterly: review the approved list. Remove agents no one uses, and disconnect accounts they no longer need.
When someone leaves: remove their agent connections along with their other accounts.

Sample wording: [Approver] checks company PCs for unapproved AI agents each month and reviews the approved agents list each quarter.

10. When an agent does something it shouldn’t

Make reporting easy, with no blame for honest mistakes. People who report a mistake quickly are worth far more than people who hide it.

Sample wording: If an AI agent does something unexpected or you think it was used without approval: stop the task, close the app, and tell [approver] the same day. Don’t delete anything. [Approver] will disconnect its accounts, change any affected passwords and remove the agent if needed.

Our step-by-step guide on how to stop an AI agent on Windows 11 covers stopping a task, ending it in Task Manager, removing it from startup and disconnecting its accounts.

A one-page AI agent policy you can adapt

Here’s how those ten parts fit together on one page. Replace the bracketed text, delete what doesn’t apply and add your own data categories. This is a starting point, not legal advice; if your business has regulatory obligations, have a qualified advisor review it.

[Company name] AI Agent Policy · Effective [date] · Owner: [approver]

1. Scope. This policy covers AI agents: software that uses AI to take actions on a computer or account, such as clicking, typing, changing files or sending messages. It applies to everyone using company computers or accounts.

2. Approved agents only. Only agents on the approved agents list may be installed, connected or used for company work.

3. Requests. Ask [approver] before installing or connecting any new agent. Include what it does and which accounts it needs.

4. Off-limits data. Agents must not access client records, payroll and HR files, bank or payment accounts, or saved passwords.

5. Least access. Connect agents only to the folders and accounts listed for them. Use read-only access where possible. Use standard Windows accounts for daily work.

6. People approve big actions. A person must approve before an agent sends outside the company, pays, deletes or moves shared files, installs software or changes settings.

7. Windows 11 settings. Experimental agentic features stay off unless [approver] turns them on for an approved agent.

8. Browser extensions. Only approved extensions in browsers used for company work.

9. Checks. Monthly PC checks; quarterly review of the approved list.

10. Problems. Stop the task, close the app and tell [approver] the same day.

I have read and will follow this policy. Name: ________ Date: ________

How to roll it out in one week

You don’t need a project plan. For an office of 5 to 25 PCs, this is enough:

Day 1: Take stock. Ask everyone which AI tools and extensions they use for work. Make it clear the question isn’t a trap; you want an accurate list.
Day 2: Check the PCs. Use the manual checks below on each computer and compare the results with what people told you.
Day 3: Build the approved list. Approve the tools that are useful and can be limited sensibly. Pick the smallest access that works for each.
Day 4: Write the policy. Adapt the one-page version above and name your approver.
Day 5: Share and sign. Walk the team through it in 15 minutes, answer questions and collect signatures.
Day 6: Tidy up. Remove agents and extensions that didn’t make the list, and disconnect accounts they used.
Day 7: Book the first monthly check. Put it on the calendar with a name next to it.

How to check a Windows 11 PC by hand

These checks use only what’s built into Windows 11. Our guide on how to tell if an AI agent is running on your Windows PC goes into more detail.

Running apps. Press Ctrl + Shift + Esc to open Task Manager and look through the Processes tab for AI apps you don’t recognize.
Startup apps. Go to Settings > Apps > Startup (or the Startup apps tab in Task Manager). Microsoft notes that apps registered with a startup task can be turned off here so they don’t start when you sign in.
Installed apps. Go to Settings > Apps > Installed apps and compare the list with your approved agents.
Browser extensions. In Microsoft Edge, open edge://extensions. In Google Chrome, select More > Extensions > Manage extensions. Check each one against the approved list.
Windows agent settings. Open Settings > System > AI components and confirm Experimental agentic features is set the way your policy says.
Account types. Go to Settings > Accounts > Other users to see who has administrator rights. Microsoft recommends keeping that number small.

Write down what you find for each PC, with the date. That record is what turns a one-time cleanup into an ongoing policy.

Where manual checks fall short

Manual checks are worth doing, but they have limits:

They’re a snapshot. You see what’s running when you look, not what ran yesterday afternoon.
They take time per PC. Six checks on 25 computers every month adds up quickly.
Names aren’t always obvious. An AI helper can run under a generic process name or as part of a larger app.
Cloud agents leave little trace on the PC. Some agents work on the vendor’s systems through connected accounts, so you also need to review connected apps on the account side.

None of this means you should skip the checks. It means the policy works best when you also have an easier way to see AI-agent activity on each PC between checks.

How PERCARIS helps

PERCARIS surfaces recognized AI-agent activity on your Windows computer and gives you a Stop control for agents you did not authorize. PERCARIS recognizes known AI tools. It won’t flag every AI agent.

That fits the policy above: your approved list says which agents belong, and PERCARIS shows you what it sees on each PC so you can compare. You decide whether to press Stop. It works alongside your existing security tools.

For a small office, it’s worth knowing how it’s set up. PERCARIS is installed on each Windows PC, and each PC is managed on its own, with no central console. One license key covers your plan’s PC count. Plans cover 1, 5 or 25 PCs, and for 26 or more PCs you can contact support@percaris.com. See plans.

FAQ

What is an AI agent policy?

It is a short set of written rules that says which AI agents your business allows, what they may access, who approves new ones and what to do when one acts without approval. It covers software that takes actions, not just chat tools.

Do I need a separate AI agent policy if I already have an AI use policy?

Not necessarily. Many small businesses add an AI agents section to the AI use policy they already have. What matters is that the agent rules are written down, short and actually checked.

Who should approve AI agents in a small business?

Name one person. In a very small office that is often the owner; in a larger one it may be the office manager or your outside IT provider. One clear approver keeps requests from stalling or slipping through.

How often should we check our PCs for AI agents?

A monthly check of each PC and a quarterly review of the approved list works for most small offices. Also remove agent connections when someone leaves.

Sources

Product features change often. Checked against each source on October 31, 2026. The sample policy is a starting point, not legal advice.

— The PERCARIS Team