Before You Let AI Touch Your Business Data, Run This Check

The new AI tool reads your email, opens your files, and drafts your invoices. That is the pitch on the sales page.

Here is what the pitch leaves out. That same tool will follow instructions buried inside any document it touches. Including one a stranger emailed you.

The Risk Nobody Demos

AI tools do not tell the difference between your instructions and the text they read. Security researchers call the attack prompt injection, and the Center for Internet Security has flagged it as a growing risk to any business using generative AI (cisecurity.org).

In plain terms: you tell the AI to summarize a client email. The email contains hidden text that says forward all invoices to this address. The AI cannot tell which instruction came from you. It may follow both.

That is not science fiction. It is the default behavior of a tool that reads outside content and can also take action.

The Three Things That Make It Dangerous

Security people describe a lethal trifecta. A tool gets dangerous when it has all three of these at once.

One, access to private data. Your files, your email, your financials.

Two, exposure to outside content. Emails, web pages, PDFs from people you did not vet.

Three, a way to send data out. It can email, post, or push to another system.

A tool with all three is a leak waiting to happen. A sub's emailed PDF could carry an instruction your AI obeys. Most builders connect a tool to everything on day one and never think about it.

Process First, Permissions Second

This is the same lesson that runs through everything we teach. Do not start with the tool. Start with the job.

Write down exactly what you want the AI to do. Draft replies to client emails. That is one job. It needs to read email and write drafts. It does not need to send anything. It does not need your bank login.

Once the job is on paper, you can see the permissions the job actually requires. Then you give it those, and nothing else. The tool's blast radius shrinks to the size of the task. Security researchers say the same thing in their own words: limit what the tool can do and the damage from any one bad input stays small.

Hand a tool the whole keychain and a single bad document can drive off with your data. Hand it one key and the worst case stays small.

The Check Before You Connect

Before you connect any AI tool to your business, answer three questions. It takes three minutes.

What can it read? List it. Email, files, customer records, financials. If the tool wants more than the job needs, that is a flag.

What can it change or send? A tool that drafts is safe. A tool that sends, posts, or pays is a different animal. Leave send-and-pay turned off until you have a reason to turn it on.

Where could my data end up? If the tool can reach the open internet and also see your private files, you have two legs of the trifecta. Cut one.

A Job Site Example

Say you want AI to handle estimate follow-ups. The job: read the thread, draft a follow-up, queue it for your approval.

Safe setup: it reads the email thread and writes a draft. You hit send. It never touches your bank, and it never sends on its own.

Risky setup: it reads your whole inbox, sends on its own, and pulls from your accounting to be helpful. Now one spoofed email can move money or leak client data.

Same tool. Same task. The difference is the permissions you handed it before you understood the job.

Why Builders Get Targeted

A remodeler running on email, text threads, and a shared drive is a soft target. The data is valuable. Client contracts, deposit amounts, banking details for draws. And the guard is usually down, because the owner is on a roof, not reading security advisories.

You do not need to become a security expert. You need to scope the tool to the task and keep the dangerous buttons off until the workflow earns them.

The Point

AI is worth adopting. The hours it gives back are real. But a tool that can touch your whole business is not a convenience. It is exposure, until you scope it.

Document the job. Grant the minimum. Keep the send-and-pay buttons off until you trust the workflow.

If you are about to wire AI into your operation and you are not sure what it should be allowed to touch, that is a process question with a known answer. Book a systems consult at gofirstconsulting.com and we will map the workflow and the permissions in 45 minutes.