The Permission Ladder: a one-page sheet for AI agent permissions in a service business

The question to ask about an AI agent isn't how smart it is. It's what it's allowed to do without asking you. The Permission Ladder answers that for every task in a service business, in four rungs, and the sheet at the bottom of this page lets you write the answer down before anything goes live.

The four rungs

1. Read. The agent can look at your jobs, invoices and calls. Looking never changes anything.
2. Draft. The agent writes the follow-up or flags the overdue invoice. A bad draft just gets deleted.
3. Fixed-wording sends. Messages with locked wording, like an appointment reminder, that you switch on one at a time after you've read the drafts in the log.
4. Money and promises. Quotes, refunds, arrival times and anything that costs money or makes a promise. This rung never moves: a person does it.

Think of it like a new hire. They answer the phone on day one. They don't sign checks for months.

Why the setting matters more than the model

It's tempting to believe a smarter AI is a safer one. Security people disagree. OWASP's guide to AI risks traces the damage from agents to three causes, excessive functionality, excessive permissions and excessive autonomy, and its fixes are plain: give an agent fewer tools, narrower permissions, and a human approval for high-impact actions. Every one of those is a setting you control.

Mistakes do happen. In the Federal Reserve Banks' 2026 survey of small employer firms, 46% of firms already using AI named accuracy as a challenge. The ladder doesn't make the AI more accurate. It makes sure a wrong answer stays a draft.

Who this is for and what you need first

This is for an owner or office manager about to let an agent work inside the software they run, or who already has one and isn't sure what it can do. You're early if you're here: the Census Bureau found 19.8% of US businesses were using AI as of May 2026, so most of your peers haven't set these rules either.

You need:

• A list of the tasks you want help with (follow-ups, reminders, invoice nudges, review requests, morning reports).
• Who in your office owns each task today.
• Where the agent's actions get logged, so you can read them.

Rung one is reading

Every task starts here. The agent gets read access to exactly the records the task needs and nothing else.

• A missed-call follow-up needs the call log and the customer's name. It doesn't need payroll.
• An overdue-invoice flag needs invoices and payments. It doesn't need the schedule.

Write the records next to the task on the sheet. If you can't say why the agent needs a record, it doesn't get it.

Rung two is drafting

Most tasks should live on this rung for a long time, and many forever. The agent writes the message, the invoice or the note, and a named person approves, edits or rejects it.

You'd think drafting is the risky part. It isn't. A draft nobody sends can't hurt anyone, so this is where you learn what the agent gets right and what it gets wrong. Read every draft for the first few weeks. Note every edit you make and why.

Rung three is fixed-wording sends

Some messages are the same every time except for a name, a date and a time. Appointment reminders are the classic case. For those, and only those, you can let the agent send without a per-message approval, once you've earned the confidence.

The test to move a task up to rung three:

1. The wording is locked. The agent fills in fields; it doesn't write sentences.
2. You've read its drafts in the log for at least two weeks and made no edits to the wording.
3. There's a stop word or an opt-out that works, and you've tested it.
4. You switch on one message type at a time, and you know how to switch it off.

Anthropic's guide to building agents recommends extensive testing in sandboxed environments, with appropriate guardrails, before you trust an agent with more. For a small business, reading two weeks of drafts in the log is that test.

Rung four is money and promises

This rung never moves. A person handles:

• Quotes, prices and discounts
• Refunds and credits
• Arrival times and completion dates
• Anything that admits fault, promises a fix or mentions a lien or a late fee

The agent can prepare these. It can draft the quote from the estimate or flag the refund request. But a person decides and sends. That's the default on our trust page: each agent has defined access, sensitive actions need approval, and nothing sends unless you've allowed it.

The Permission Ladder sheet

Copy this table for your own tasks. One row per task.

Task	Owner today	Records it reads (rung 1)	What it drafts (rung 2)	Fixed sends? (rung 3)	Stays with a person (rung 4)	Rung today	Review date
Missed-call follow-up	Dispatcher	Call log, customer name	Text asking what they need	Not yet	Arrival time, price	2
Appointment reminder	Office	Schedule, customer phone	Reminder text	Yes, after 2 weeks of clean drafts	Changing the time	3
Overdue invoice nudge	Billing	Invoices, payments	Reminder with invoice link	No	Payment plans, late fees	2
Estimate follow-up	Sales	Estimate, customer notes	Follow-up mentioning the job	No	Discounts, revised price	2
Review request	Office	Job ticket, tech name	Request with review link	Maybe later	Replying to complaints	2

A filled row should answer three questions at a glance: what can it see, what can it do alone, and what does it never do.

What to watch out for

• Permission creep. A task gets a new record "just for now" and keeps it. Review the sheet monthly.
• Two rungs at once. Never move a task from draft straight to sending with new wording. Lock the wording first.
• The quiet failure. A fixed send that breaks (a bad field, a wrong time zone) can go out a hundred times before anyone notices. Read the log weekly even for rung three.

How to tell it worked

At the end of each month, look at the sheet and the log together. Every task should have a rung, an owner and a review date. The edits you make to drafts should drop over time for the tasks that are ready to move up, and stay steady for the ones that aren't. That's your evidence, not a feeling.

There's more on where an agent should stop in our guide to an AI agent that takes actions, and human-in-the-loop shows the approval queue. If you'd like the ladder filled in for your company, your free AI Operations Audit does exactly that.