๐ฅ
14h โข The Weekly Stack
๐ง๐ต๐ฒ ๐ฑ ๐ฅ๐๐น๐ฒ๐ ๐๐ผ ๐ฆ๐ฒ๐ ๐๐ฒ๐ณ๐ผ๐ฟ๐ฒ ๐ฌ๐ผ๐ ๐๐ฒ๐ ๐๐ ๐ง๐ผ๐๐ฐ๐ต ๐ฎ ๐๐น๐ถ๐ฒ๐ป๐ ๐๐ฐ๐ฐ๐ผ๐๐ป๐
Alright, DE fam. Grab your coffee.
This is something I rarely see mentioned in our rush to get AI to do more for us.
Today's tactic: five rules that decide what an AI tool is allowed to see, change, send, and delete inside a client account.
AI can save you hours a week. It can also wreck a client relationship in about 30 seconds if you hand it too much freedom.
Most agency owners find out which one they built the hard way. On a Monday.
Let's fix that.
๐๐ถ๐ฟ๐๐, ๐๐ฒ๐'๐ ๐๐ถ๐น๐น ๐ฎ ๐๐ฎ๐ฑ ๐๐๐๐๐บ๐ฝ๐๐ถ๐ผ๐ป
Here's the thinking I hear in every "connect everything" tutorial.
"I told the AI not to touch anything. So it won't."
Read that again.
A prompt is not a permission.
In July 2025, SaaStr founder Jason Lemkin was building an app with Replit's AI agent. He had the project in a code freeze. The agent deleted the live production database anyway. It held records on more than 1,200 executives and nearly 1,200 companies. The agent told him it couldn't be recovered. He got the data back himself. Replit's CEO called it "unacceptable and should never be possible."
Instructions were in place. The access was also in place. Access won.
OWASP, the group behind the standard security lists for web apps, put this on its Top 10 for AI applications as "Excessive Agency." It names three causes: the AI has more functions than it needs, more permissions than it needs, and no human approving the high-impact stuff. Their fix is the same three things in reverse.
Notice what's not on the list. "Write a better prompt."
Prompts are suggestions. Permissions are walls. Build walls.
Receipts: genai.owasp.org/llmrisk/llm062025-excessive-agency and Gizmodo's July 23, 2025 report on the Replit incident.
๐ช๐ต๐ ๐ง๐ต๐ถ๐ ๐ ๐ฎ๐๐๐ฒ๐ฟ๐ ๐ณ๐ผ๐ฟ ๐ฌ๐ผ๐๐ฟ ๐๐ด๐ฒ๐ป๐ฐ๐
Run the math on one client. Every number below is a "say," so swap in your own.
Say the client pays you $1,000 a month and stays 24 months. That's $24,000 in revenue.
Say the setup in this post takes you an hour per tool. One hour against $24,000.
Now add what the client would have sent your way. Referrals. A testimonial. A case study you can show the next prospect. One bad Monday takes all of it out.
And the bad Monday doesn't have to be a database. It's an automation emailing 4,000 customers the wrong offer. It's a GBP post that goes live with the wrong phone number. It's a deleted page nobody can find.
You don't lose the client over the mistake. You lose them because you didn't have a rule that could have stopped it.
That's not a tool problem. That's an agency problem.
๐ฆ๐๐ฒ๐ฝ ๐ญ: ๐๐ถ๐๐ฒ ๐๐ ๐๐ต๐ฒ ๐ฆ๐บ๐ฎ๐น๐น๐ฒ๐๐ ๐๐ฒ๐
This is the principle of least privilege. Fancy name, simple rule. The AI gets access to what the task needs and nothing else.
Read-only is the default. Admin is never the default.
Here's how to set it up:
Write the task in one sentence. "Draft four GBP post ideas a month." Not "help with Google."
Ask two questions. What does it need to see? What does it need to change? Most of the time the answer is "see a lot, change nothing."
Create a separate login or connection for the AI. Never hand it your own admin login. A separate login means you can see what it did, and you can shut it off without locking yourself out.
Pick the lowest role the platform offers. Viewer or read-only first. Move up only when a task fails because of it, and only one notch.
Connect one account, not all of them. If the connection screen says "allow access to everything," that's the wrong screen.
Write down what you granted. You'll use it in Step 6.
Admin access is for people you can talk to. Not for tools that say "I panicked" afterward.
๐ฆ๐๐ฒ๐ฝ ๐ฎ: ๐ฃ๐๐ ๐ฎ ๐๐๐บ๐ฎ๐ป ๐๐ฒ๐๐๐ฒ๐ฒ๐ป ๐๐ต๐ฒ ๐๐ฟ๐ฎ๐ณ๐ ๐ฎ๐ป๐ฑ ๐๐ต๐ฒ ๐๐๐๐๐ผ๐ป
AI can draft ads, write emails, suggest GBP updates, and recommend site changes. Great. Nothing gets published, sent, changed, or deleted without a human clicking the button.
Here's the setup:
AI writes into a draft. A review doc, a draft folder, a queue. Never straight to live.
A person approves. Name the person. "The team" isn't a person.
Say it in the prompt AND enforce it in the permissions. The prompt covers the first mistake. The role covers the second.
Here's the line I put in front of any workflow:
"Draft only. Do not publish, send, change, or delete anything. Put the output in the review doc and stop."
Now the one that matters most.
The AI never deletes. Deletes happen manually, or with explicit approval each time.
I've watched an AI delete something, then explain why when I asked. The answer was basically, "You never gave me a rule that said I couldn't."
It was right. That's the sting. If you didn't write the rule, it doesn't exist.
Some of you are thinking: "So I approve everything, forever?"
No. That's not the point.
Review every single output until the tool earns a clean streak. Pick your number and write it down. Say 20 in a row with nothing you had to fix. Then lighten the review on low-risk drafts.
Three things never leave the gate, no matter how good the streak is: anything that deletes, anything that spends money, and anything that sends to a customer list.
๐ฆ๐๐ฒ๐ฝ ๐ฏ: ๐ฆ๐ผ๐ฟ๐ ๐๐ต๐ฒ ๐๐ฎ๐๐ฎ ๐๐ฒ๐ณ๐ผ๐ฟ๐ฒ ๐๐ ๐๐ผ๐ฒ๐ ๐๐ป
Protect client data like it's your own. Because to the client, it is.
Sort everything into three buckets before it touches an AI tool:
Red. Never goes in. Passwords. API keys. Payment details. Customer lists with names, emails, or phone numbers. Anything under an NDA.
Yellow. Goes in only on a business-grade plan, with training off, and a retention setting you've actually looked up. Client strategy. Reporting numbers. Ad account data.
Green. Goes in anywhere. Their public website. Their public GBP. Public reviews.
Then ask three questions about every tool. Get the answers from the tool's own privacy and data-use pages:
Where does my data go?
How long is it kept?
Is it used to train the model?
If you can't find the answer in writing, the tool is a red-bucket tool. Period.
One catch. The answers can change by plan. The free version of a tool and the business version often treat your data differently. Check the plan you're actually on, not the one in the marketing.
Tell the client, too. Put this line in your onboarding:
"We use AI tools for drafts and analysis. Nothing goes live without a human reviewing it, and we never put your passwords, payment details, or customer lists into an AI tool."
Clients don't fire you for saying that. They fire you for hiding it.
๐ฆ๐๐ฒ๐ฝ ๐ฐ: ๐ง๐ฒ๐๐ ๐ผ๐ป ๐๐ฎ๐ธ๐ฒ ๐๐ฒ๐ณ๐ผ๐ฟ๐ฒ ๐ฅ๐ฒ๐ฎ๐น
Test before you trust. And test on YOUR business first, never on a client's.
Run it in this order:
Your own business. Your sub-account, your GBP, your list.
A sandbox or test account with fake data. Fake contacts, fake emails to yourself.
The smallest possible live run. Five contacts, not 4,000. One post, not the whole month.
Four things to check on every test:
Accuracy. Is the output right? Read it, don't skim it.
Permissions. Try to make it do something it shouldn't be able to. Ask it to delete. Ask it to change a setting. It should fail. If it works, your Step 1 is broken.
Integrations. What else does this touch? A tool connected to your CRM and your email can do damage in two places.
Failure. Feed it an empty field, a wrong date, a missing name. What happens? "It sends anyway" is a bad answer.
Then write the rollback plan BEFORE you launch.
One short paragraph: how do we undo this, where is the backup, and who does it. Write it while you're calm. You will not write it well at 7 AM on a Monday with the client on the phone.
Because discovering your automation has been emailing 4,000 customers the wrong offer is a lousy way to start the week.
๐ฆ๐๐ฒ๐ฝ ๐ฑ: ๐๐ฒ๐ฒ๐ฝ ๐ฎ ๐๐ผ๐ด ๐ฎ๐ป๐ฑ ๐๐ป๐ผ๐ ๐ช๐ต๐ฒ๐ฟ๐ฒ ๐๐ต๐ฒ ๐ข๐ณ๐ณ ๐ฆ๐๐ถ๐๐ฐ๐ต ๐๐
Every AI action should be traceable. And you need a way to stop it right now.
The log. Four columns in a Google Sheet:
What changed
When
Which tool did it
Who approved it
That's it. If a client asks "what happened to my page?" you can answer in a minute instead of a week.
The kill switch. Know the one place you turn this automation off. Write down where it is and who's allowed to press it. Usually that's two moves: pause the workflow, and revoke the connection.
Then press it once, on purpose, on a test. If you've never found the switch under calm conditions, you won't find it in a crisis.
Here's the part nobody says out loud. A log doesn't stop a bad action. OWASP is blunt about that: logging and monitoring limit the damage after the fact, but they don't prevent it.
Steps 1 and 2 do the stopping. Step 5 does the cleanup.
๐ฆ๐๐ฒ๐ฝ ๐ฒ: ๐ฃ๐๐ ๐๐ ๐ผ๐ป ๐ข๐ป๐ฒ ๐ฃ๐ฎ๐ด๐ฒ
Rules in your head don't count. Build the AI Access Sheet.
One row per tool, per client. Eight columns:
Tool
Client
What it can see
What it can change
Who approves
Where the log lives
Kill switch (where it is, who presses it)
Date last tested
Fill in the first four from Step 1. Approver from Step 2. Log and kill switch from Step 5. Test date from Step 4.
If you can't fill in a cell, you found the hole. That's the point of the sheet.
Review it on the first of every month. Five minutes. Any tool that's no longer in use gets its access revoked that day.
๐ง๐ต๐ฒ ๐ง๐ผ๐ผ๐น ๐ฆ๐๐ฎ๐ฐ๐ธ
Credentials: a password manager like 1Password or Bitwarden. Passwords live there. They never get pasted into an AI chat, ever.
Access control: the user roles inside each platform you already use. Make a separate AI user in each one.
Review queue: a shared folder of draft docs, or a "draft" status inside your CMS or CRM.
Log and Access Sheet: a Google Sheet. You don't need software for this.
Kill switch: the pause and disconnect controls inside the platforms and tools that already run the automation.
Verify pricing before you buy, this space moves fast.
One caution. None of these tools makes the judgment call. A log tells you what happened. It doesn't tell you whether it should have. A role setting only works if you set it low. The tools hold the rules. You still write them.
๐ช๐ต๐ฒ๐ฟ๐ฒ ๐๐ด๐ฒ๐ป๐ฐ๐ ๐ข๐๐ป๐ฒ๐ฟ๐ ๐ฆ๐ฐ๐ฟ๐ฒ๐ ๐ง๐ต๐ถ๐ ๐จ๐ฝ
Mistake 1: Trusting the prompt instead of the permission. "I told it not to." Great. Does the account agree?
Mistake 2: Handing the AI your own login because it was faster. Now you can't tell what it did from what you did, and you can't shut it off without shutting yourself out.
Mistake 3: Testing on the live client because it's "a small change." Small changes are where you skip the check. They are also where the 4,000-email Mondays start.
Mistake 4: Building the kill switch after you need it. You find out where the off button is while the damage is still running.
๐ง๐ต๐ฒ ๐๐ผ๐น๐ฑ๐ฒ๐ป ๐ฅ๐๐น๐ฒ
AI can recommend. AI can prepare. AI can execute approved tasks.
But the agency stays accountable.
Your client hired you to manage their business. Not to turn their account into an unsupervised AI science experiment.
๐ฌ๐ผ๐๐ฟ ๐๐ฐ๐๐ถ๐ผ๐ป ๐ฆ๐๐ฒ๐ฝ ๐ง๐ต๐ถ๐ ๐ช๐ฒ๐ฒ๐ธ
Build the AI Access Sheet for ONE tool. Just one.
Pick the AI tool you use most on a client account. Fill in the row. Access, approver, log, kill switch.
If any cell is blank, fix that cell this week. If the tool has admin access and doesn't need it, drop it a notch today.
Don't go back and audit every tool you've ever connected. That's next week.
Drop your row in the comments below, with the client name stripped out. I'll give you feedback on what's too loose.
And tell me this: what's one thing an AI tool can touch in your agency right now that it shouldn't?
That's it for this Tactic Tuesday. Go build something.
3
0 comments
๐ง๐ต๐ฒ ๐ฑ ๐ฅ๐๐น๐ฒ๐ ๐๐ผ ๐ฆ๐ฒ๐ ๐๐ฒ๐ณ๐ผ๐ฟ๐ฒ ๐ฌ๐ผ๐ ๐๐ฒ๐ ๐๐ ๐ง๐ผ๐๐ฐ๐ต ๐ฎ ๐๐น๐ถ๐ฒ๐ป๐ ๐๐ฐ๐ฐ๐ผ๐๐ป๐
powered by
skool.com/digital-edge-5127
Designed for people looking to start or grow a digital agency, come network with like-minded people who are building success on their own terms.
Suggested communities
Powered by