20 questions to ask before connecting an AI assistant to your business

Before you connect an AI assistant to your inbox, drive or CRM, you need answers to four things: what it can reach, where that data goes, who can see what it did, and how you switch it off. The 20 questions below cover those in order. Ask them in writing, keep the replies with your records, and treat a vague answer as a no.

Connecting an assistant is an access decision, not a software install. Once it is connected, it can read whatever the integration allows, and a model reading your email is a model that can be steered by whoever writes to you. The questions are designed for an owner-operator or a small team without an IT department. Where they touch on where data is processed and whose laws apply, our guide to sovereign AI for Australian operators goes deeper.

Access: what the assistant can reach

Start here because it determines the damage any other failure can do. The OWASP Top 10 for LLM Applications names excessive agency as a core risk: too much functionality, too many permissions or too much autonomy.

• 1. Exactly which permissions does the integration request? Read mail, send mail, delete mail and manage settings are four different things. Ask for the list, not a summary.
• 2. Can I start read-only and add write access later? If the answer is no, the product was built for convenience over control.
• 3. Does it connect as me, or as a separate account I can limit? Agents working under your own login inherit everything you can do.
• 4. Can I limit it to specific folders, labels, pipelines or files? 'All of Google Drive' is rarely what a task needs.
• 5. What can it do without my approval? Drafting is low risk. Sending, deleting, paying and publishing are not.

We go through how to set those permissions in practice in least-privilege access for AI agents.

Storage and location: where your data goes

• 6. Which model providers process my prompts and files, and in which regions? You want company names and regions, not 'leading AI providers'.
• 7. Where are my files, outputs, logs and backups stored? These are often in different places.
• 8. Which sub-processors handle my data, and how will you tell me when that changes?
• 9. Is there an Australian-hosted option for sensitive work, and what does it cover? A local model option doesn't make your email provider local.

If you are covered by the Privacy Act, these answers feed directly into your obligations under APP 8 on overseas disclosure and APP 11 on security. Our Privacy Act and AI tools guide explains both in plain terms.

Training and retention: what happens to your data afterwards

• 10. Is any of my data used to train or improve a model, yours or a third party's? Get the answer for each provider in the chain, and check whether it is a default you must switch off.
• 11. How long are prompts and outputs retained, and by whom? Ask this separately from training: 'we don't train on your data' says nothing about how long the data is kept.
• 12. Can staff at your company or the model provider read my content, and under what circumstances? Support and safety review are legitimate reasons; you still need to know.

Logging and oversight: can you see what it did

• 13. Is every action logged: who asked, what was read, what was changed, who approved? A chat transcript is not the same thing.
• 14. Can I see and export the log myself, without a support ticket?
• 15. How are logs protected from the assistant itself? An agent should never be able to edit or delete the record of what it did.
• 16. Will I be told about unusual activity, such as a burst of reads or a new recipient?

The Australian Signals Directorate's advisory on agentic AI harnesses recommends recording prompts, responses, tool invocations, approvals, actions, security events and configuration changes, and protecting and independently reviewing those logs. That is a good bar for a vendor's answer. Our piece on audit trails for AI agent actions turns it into a field list.

Approvals: who has the final say

• 17. Can I require approval for every outgoing email, SMS, payment or publish, and is that the default?
• 18. What does the approval show me? The exact draft and recipient, or a summary? You can only approve what you can see.

Approval gates are also your main defence against manipulated content. An assistant that reads email can be fed instructions by a stranger; a gate means those instructions end up as a draft you reject rather than a message that left your business. We cover the attack in prompt injection through email and the design of gates in approval gates for autonomous agents.

Offboarding: how you switch it off

• 19. How do I revoke access, and does revoking one integration revoke the tokens behind it?
• 20. How do I export my data, and how do you confirm deletion when I leave?

Most businesses ask these last and regret it. Ask them first, then revoke a test integration during your trial and confirm the assistant really lost access.

How to score the answers

Our rule: any red on questions 1, 5, 6, 10 or 17 means no connection to client data. Those are the questions about reach, autonomy, location, training and approval. Everything else can be worked around with process; those can't.

Run the trial on a safe test dataset first

Even with good answers, don't run your first trial on live client records. Build a small test set instead: a dummy mailbox or label with 20 to 30 realistic emails, a spreadsheet of made-up contacts, and a few sample documents with names and numbers changed. Include awkward cases on purpose: a complaint, an email with an attachment, a message asking the assistant to do something it shouldn't.

• Use invented names and obviously fake details (a 0400 000 000-style number, an example.com address). Changing only the first name of a real client is not de-identification.
• Write down what a good result looks like before you start, so you judge the output rather than the demo.
• Try revoking access at the end and confirm the assistant can no longer read the test data.
• Only move to real data for one narrow workflow once the test run behaves.

If you want a structured first fortnight after that, your first week with an AI assistant suggests which tasks to hand over first.

When the honest answer is not yet

Sometimes the right outcome of this checklist is to wait. If your work is mostly sensitive information, you have no one to review drafts, and no vendor you have spoken to can tell you where prompts are processed, keep AI to tasks that don't touch client data until that changes. That isn't anti-technology; it's sequencing.

For reference, these are the answers for Fulcrum Cortex in the terms we can stand behind: the company is 100% Australian owned, sovereign AI models are available from SCX.ai for work that needs them, and agents are approval-first, drafting emails and SMS for you to approve before anything goes out. The platform page and our privacy policy cover the rest, and we're happy to answer the other questions in writing.