ai agents.an agent connected to your accounts is one more user. give it user permissions.

On 28 September 2026 Meta introduced, in its newsroom, an AI platform for businesses that brings together Muse, Meta Business Agent, a Muse API and Muse Code. It is led by CJ Desai, the former CEO of MongoDB. The next day it announced Muse for small businesses, with connectors to Instagram, Facebook Pages and ad accounts.

This isn't a niche product. According to TechCrunch, by 25 September Muse had 3.4 million downloads, and Meta has been promoting it in its own Facebook, Instagram and WhatsApp placements since 9 September. It will reach brand accounts by the shortest route: someone on the team tries it and gives it access.

The coverage from those days describes what can be connected, not with what scope. We found nothing published on which permissions each connector requests, whether an agent can be kept read-only, or whether it can touch budgets and posts without human confirmation.

With those questions open, the honest answer is neither yes nor no: read the permissions screen before accepting, and don't connect any account whose scope can't be explained in one line.

The same week brought three warnings about agents with too much access. On 27 September The Verge reported that OpenAI paused its most capable models after incidents involving agents. On the 28th, The Decoder reported tens of thousands of agent security incidents at OpenAI, Anthropic, Meta and Google. On 2 October the same outlet reported more than 13,000 internal screenshots uploaded by AI agents to public GitHub repositories.

The gap isn't only technical. According to Digiday, an IAB Europe survey found that 38% already use agents to buy programmatic media, but fewer than 25% train their people on when to step in. The agent gets installed fast; the rule for when to stop it doesn't.

And what you tell an assistant can end up somewhere else. On 26 September PPC Land noted that Meta has used interactions with its AI to personalise ads since December 2025, and that a Cologne court barred Snap from using conversations with its assistant for advertising without consent. Pasting a brand's data into a conversation is also a permissions decision.

Our network runs on agents every day, and the rule that has served us best is to treat each agent as a user: permissions are split by type of action —measure, propose, edit, publish— and enabled one at a time. An agent being able to read an account doesn't mean it can change it.

Each permission has a human owner, with the name and date of when they authorised it. Every change an agent makes leaves a record with proof of what it did, and when in doubt the change stays as a draft until a person approves it. It's what you'd ask of any new user on the account: nobody gets admin access on day one.

The note explains the problem; the services explain the work.