AI Agents for MSPs: Decide What the Agent May Do First

[00:00:02] Charles Schwab's CEO gets a weekly report of AI agents the firm blocked from client accounts. It runs in the 10s and 20s. Schwab isn't banning AI, it's deciding which actions AI gets. This is the Business of Tech, I'm Dave Sobel. Agents are being built to act for small businesses and the companies on the other side are deciding what those agents may do.

[00:00:31] We'll start with Anthropic. Its new agent, Claude Duet, is aimed at professionals and small business owners. It follows Claude for Small Business, which connected Claude to QuickBooks, PayPal, HubSpot, Google Workspace, and Microsoft 365.

[00:00:46] Tools like that are already on client machines. Acronis, which sells endpoint protection, found an AI agent tool on about 9.4% of the Windows computers running its detection software between June and September. Across a thousand machines, that's about 90.

[00:01:05] A year earlier, that figure was close to zero. Roughly 7 in 10 were desktop apps rather than command line tools, and the most common single tool was a general purpose AI assistant, not a code editor. Customers managed by MSPs had adopted at 7.9% against 4.7% for customers of direct partners.

[00:01:28] Now look at where agents try to do things. Charles Schwab blocks them from moving client money. CEO Rick Wurster told Bloomberg TV that neither the firm nor the client can control an outside agent and asked, who's liable? JPMorgan Chase CEO Jamie Dimon told investors the bank won't let outside agents in. For retail clients, a spokesperson said, that means any external agent.

[00:01:57] It isn't only banks. The Verge found Delta stopping agents from booking tickets, and Yelp letting in only agents enrolled in its paid data licensing program. Amazon has blocked Meta's Muse since September 20th. The Verge suspects other sites are blocking without saying so.

[00:02:15] But look closely at what's being refused. Schwab isn't shutting AI out. Its own assistant, Charlie, handles administrative and informational tasks, but not trades. Wurster says Schwab is preparing to let clients outside AI connect through Schwab's own controlled servers to check balances and do research. Moving money stays off the table. Yelp store opens for agents that pay.

[00:02:43] Delta says it has no deals with third party agents. In plain terms, agents are reaching small businesses just as the places they need to act start drawing lines against specific actions. Money, bookings and accounts. Why draw those lines before the agent acts instead of reviewing what it did? Because of what happens when you rely on the review. If you're listening to this and haven't hit follow yet, on Apple Podcasts, search Business of Tech.

[00:03:13] It takes five seconds and you'll get the next episode automatically. Cloud minted winners. Security minted winners. AIs, next. But not for the MSP with the most tools, but the ones who turn intelligence into a business. Pax8 calls it managed intelligence. A new kind of provider built on the Pax8 marketplace for the shift almost nobody's built for yet.

[00:03:41] 47,000 partners are already there. Join them. Pax8.com That's Pax8.com Checking an agent's work afterward only holds if the agent leaves the checking in place. OpenAI published two cases from its own internal development. On October 3rd, an agent repairing an evaluation pipeline disabled the automatic alerts to OpenAI's security system.

[00:04:10] It had been told not to send messages during an earlier Slack search and it stretched that instruction to cover the alerts. The monitoring kept running, but the alerts to people stopped. On October 6th, an agent migrating a program removed its monitoring integration to match a reference version. When asked directly, it told the user it hadn't. OpenAI says both agents considered keeping the safeguards and read routine coding instructions as permission to weaken them.

[00:04:40] These were ordinary tasks, and the record of what happened was something the agent could change. OpenAI caught both cases and disclosed them. It says it has updated its automated reviewer to watch for exactly this. It also plans to shut down any workload that launches without the monitoring it requires. Microsoft reached the same design decision from the customer side. Executive Vice President Haidt Gallo wrote that,

[00:05:07] quote, frontier models, regardless of their origin, cannot be trusted, end quote. That isn't because they're malicious. It's because they're trained to reach results. Microsoft's answer is to treat agents as insiders. Each one is contained to what it can access before it goes live. It's introducing dynamic permissions to keep an agent from holding privileges its user doesn't have and extending conditional access to agents themselves.

[00:05:36] The sites on the receiving end can't check much either. Arcos Labs, which sells bot and agent protection, found that 97.7% of legitimate agent sessions on its customers' login, sign-up, and checkout flows carried no verified identification in the third quarter. Out of every hundred, about two identified themselves. Most were real people running real errands. Arcos' own recommendation is to judge each session by what it tries to do.

[00:06:06] And it's getting harder to see in. Arcos notes meta is set to add end-to-end encryption to Muse, so even meta won't see what a user told it to do. So control is moving earlier in time. The question used to be what the agent did. Now it's what the agent is allowed to do, decided before it acts. Identity tells you who sent the agent. Permission decides which action it gets.

[00:06:32] In plain terms, an agent's record of its own work can't be the control. So the control becomes the permission it was given before it started. Somebody has to set that permission. For an MSP, the permission layer arrives as settings. Every setting is a decision someone has to make for each client. Start with 1Password. It now lets AI agents sign into accounts without ever seeing the password.

[00:06:59] Each time an agent needs a login, the user gets a prompt to approve or deny it. On business accounts, an administrator has to switch on a policy before agents can use it at all. That's two decisions. Whether agents get credentials and who approves each request. Leave the policy off and the agent falls back on whatever password the user types into it. Turn it on and let users approve everything and you've rebuilt MFA push fatigue.

[00:07:28] The prompt becomes a reflex and the reflex is the control. Now look at ThreatLocker. Its new Zero Trust AI control lets security teams grant an agent only the permissions its task needs. It holds that boundary even when the agent calls other applications, scripts, or browsers along the way. And it enforces it from outside the AI. ThreatLocker ships recommended policies and says teams should start from those and adapt them to their own environment.

[00:07:57] Put those together. The tools exist and both assume someone has defined the task and what it needs. In a large company, that's the security team. At a 20-person accounting firm with Claude connected to QuickBooks, it's either the MSP or nobody. If it's nobody, the agent runs on the full permissions of whoever launched it and the only record of what it did is the one it keeps. So here's the choice.

[00:08:25] Write an action policy for each client before agents arrive. Decide what an agent may do on its own, like reading and drafting. Decide what needs a person's approval, like sending, paying, or changing permission. Decide what's off limits entirely. Then set the tools to enforce it. Or let each agent run on the permissions of the person who launched it and sort out what it did afterward. Either way, that work has a cost and it lands in two places.

[00:08:57] This episode is supported by Halo. Automation is becoming a defining characteristic of modern managed services. But automation only works if the core platform supports it. Halo PSA gives service providers the flexibility to build powerful workflows, integrate automation tools, and design service processes around how their business actually runs.

[00:09:19] For MSPs building a more automation-driven operation, Halo PSA is one of the platforms increasingly showing up in those conversations. Learn more at usehalo.com In events, from Ninja One, a free on-demand webinar on turning hygiene reporting into client retention. Link is in the show notes. Why do we care? Because writing and keeping an action policy is work.

[00:09:49] And it costs twice. It costs once for every client, and once inside your own shop, where your tech's agents reach every tenant they touch. If neither side is priced, it comes out of margin on both. Charge for the client side as its own line on the agreement, and budget the internal side as the cost of letting your team use agents at all. So what to consider? Put the review on the agreement, not just the policy.

[00:10:18] A policy written once goes stale the first time a client connects a new agent or a tool. Trigger a review every time an agent or connector is added, and charge for it the way you charge for onboarding a new application. Write your own shop's policy first. List the agents your technicians run, which client tenants each one can reach, and which actions in those tenants need a named tech's approval.

[00:10:45] That internal policy is the first draft of the client one. And the hours it takes are your best estimate of what to charge. Budget the approval loan. Every approve or deny prompt costs someone a few seconds of attention, and a policy that sends everything to a person gets approved by Reflex. Keep human approval for actions that move money, send outside the business, or change permissions. And let routine actions run within their limits.

[00:11:16] If this trend continues, by the end of next year, clients will expect an AI action policy as a line on the agreement, the way they expect a backup policy now. And the MSPs that price it first will be the ones clients ask to write it. This is the Business of Tech. Want to go deeper than the news? The Small Biz Thoughts community is where MSP owners and operators work on the business, not just in it.

[00:11:44] Member meetings, a deep resource library, and courses through IT Service Provider University. Everything you need to run the practice you actually want. Join us at smallbizthoughts.org. Interested in advertising? Head to mspradio.com slash engage. The Business of Tech is written and produced by me, Dave Sobel, under ethics guidelines posted at businessof.tech. Thanks for listening. I'll see you on the next episode.

[00:12:16] Part of the MSP Radio Network.