Meta’s September 8 announcement of the Muse personal AI agent describes app-level choices, including whether the agent may only read email or also send it. The product asks for permission before sensitive actions such as sending a message or making a purchase and provides an audit trail of completed and planned actions. Those controls point to a useful operating principle for export businesses: reading, drafting and sending are not one permission.

A company may begin with a low-risk pilot that summarizes inquiries and prepares reply drafts. To remove a copy-and-paste step, the team later grants ongoing send access. Product prices, market ownership and source documents change, but the original authorization remains. The central risk is not whether a draft sounds human. It is whether the system can take an irreversible action with stale or incorrect business context.

Separate authorization by action and time

Read access should specify the mailbox, folder, date range and fields. Draft access should create content that cannot leave the controlled workspace. Send access needs narrower conditions: sender identity, permitted recipient type, approved template family, volume limit and duration.

Price quotations, payment details, delivery commitments, contract amendments and dispute responses should remain outside unattended sending. They require the employee accountable for the underlying commercial fact. A general instruction to “follow up with leads” does not provide enough authority to make those commitments.

Project permissions also need an expiry. A trade-show follow-up agent might run for two weeks after the event and then lose access automatically. A customer transfer, employee departure or mailbox-purpose change should revoke the old grant. “We may use it again later” is not a reason to preserve production access indefinitely.

The confirmation screen should display the final recipients, sender, attachments and complete message, together with the important facts it uses. A generic “Continue?” button does not help the reviewer find an incorrect model, price or delivery date. Show the source version and why the message was generated.

Make the audit trail answer a commercial question

An API log may prove that a send call occurred while leaving sales unable to answer who requested the contact, which quotation was used, who approved it and who owns the reply. Connect the agent task, customer record, content version, authorization, confirmation, delivery result and next responsible person.

For agents that run continuously, define stop triggers outside the agent itself. A sudden increase in recipients, a new attachment type, repeated contact with the same buyer, unusual sending hours or use of an expired product record should suspend the workflow. The same system that generated an action should not be the only authority deciding that its behaviour remains safe.

Scope revocation also needs a practical mechanism. Removing a prompt instruction is not enough if a token or connected application still permits sending. The operations owner should be able to disable the grant, verify that the agent can no longer act and preserve the historical record without retaining unnecessary live access.

Our discussion of owners and stop rules for always-on agents answers who receives an exception. Permission design answers what the agent could reach before that exception. An owner makes failure actionable; narrow authorization limits its possible impact.

A small company can start with a simple matrix. Put one agent on each row and list read, draft, send, modify and pay as separate actions. Add data scope, approver, expiry and revocation method. Begin with read and draft. Add short-lived send permission only for a stable task that has been replayed against realistic cases.

The objective is not to insert confirmation into every harmless step. It is to spend human attention where an action changes an external relationship or commercial commitment. Mature automation does not mean eliminating responsibility. It means the team can explain which steps were safely delegated, which ones still require a person and how access disappears when the job is over.

Review the matrix after real incidents and ordinary handoffs, not only during setup. If a salesperson repeatedly approves the same low-risk reminder, the rule may be narrowed and automated. If reviewers discover stale attachments or ambiguous recipients, keep confirmation and repair the upstream data. Permission design should follow observed work, while every expansion remains explicit, limited and reversible.

Sources

Meta Newsroom, Introducing Muse: The World’s First Personal AI Agent Built for Everyone, September 8, 2026.