AI Acceptable Use Policy for Personal AI Agents at Work

On 8 September 2026, Meta announced Muse, a personal AI agent. According to Meta, it takes tasks and projects in charge, sends emails, opens a browser, fills in forms and negotiates on the person's behalf. Meta says it is deployed in the United States on iOS, Android and muse.ai. A business does not need to ban such tools. It needs a one-page AI acceptable use policy that says what an agent may see, what it may do without approval and what it may send in the company's name.

What do personal AI agents actually do for their users?

Meta states that Muse runs on its own dedicated computer in the cloud, where the data and credentials of every connected service are stored. A Sentinel agent, separate from Muse at the system level, runs on the same machine, and according to Meta nothing Muse does reaches the Internet without approval.

Meta also says Muse does not share a person's conversations or virtual machine data with Meta's advertising systems. Users can refuse to let their interactions train Meta's AI models, and they can ask Muse to forget information it has learned.

According to Decrypt, OpenAI presented dots at its DevDay on 29 September 2026: always-on agents that act autonomously. Each dot has its own cloud computer and browser and can connect to more than 4,000 apps. Decrypt adds that dots are reachable through ChatGPT, voice calls, Slack and Teams, and that the first dot is included in Pro and Business Premium plans in eligible markets, not in Free or Plus.

Our take: two details matter more than the product names. These agents hold credentials, and they arrive through personal phones and chat tools, outside your usual software approval route. A policy tied to one product goes stale. A policy tied to what an agent can see, do and send does not. Our overview of consumer AI agents covers the wider landscape.

What should an AI acceptable use policy cover?

A one-page policy is enough if it answers three questions in plain words: what the agent may see, what it may do, and what it may send in the company's name. Everything else, such as tool lists and vendor names, belongs in an annex that can change without rewriting the rule or asking staff to sign again.

What may a personal AI agent see?

Start from zero. Name the mailboxes, calendars, shared drives and customer files an agent may read, and open them one at a time. Personal data of customers and colleagues needs a stated purpose, so read our guide to GDPR and generative AI for SMEs before you write that line. Credentials come second: no shared passwords, and no company logins typed into a personal agent.

What may it do without asking?

Split actions into two lists. Reading, searching, summarising and drafting can run freely. Anything that changes something (paying, signing, deleting, editing a customer record, accepting terms) needs a named human to approve it first. Meta says nothing Muse does reaches the Internet without approval. Your gate can be a person rather than software, but the principle is the same.

What may it send in the company's name?

Treat every outgoing message as signed by the employee who owns the agent. No unattended emails to customers or suppliers, and no form submitted or price negotiated for the company without a human reading it first. Meta lists emails, forms and negotiation among the tasks Muse performs, so these are exactly the actions the rule needs to name.

Can software enforce the policy?

According to BankInfoSecurity on 18 August 2026, Perplexity published Numbat, an open source tool that monitors and controls autonomous AI agents inside companies. It detects and blocks agents that step outside an organisation's security policies. The article says Numbat "sits between when the agent starts to think about doing something and when it takes action". It applies policies before the action, monitors live, and allows reconstruction afterwards. The article does not state which open source licence applies.

Our take: tools of this kind enforce a policy, they do not write one. Without the written rule there is nothing to configure. Pair the policy with the risks listed in our generative AI security best practices for SMEs, then decide what, if anything, to automate.

What changes when customers use agents too?

According to Travolution on 10 September 2026, when conversations with an agent take place in WhatsApp or on Gemini, brands must keep control of the customer relationship. The article names challenges of visibility, conversion and access to conversational context data. Travolution also cites a Travelport study: for 72% of consumers, the final booking step, when handled by an AI, creates stress and anxiety.

A policy should cover inbound agents too: who in the company answers when a customer's agent writes, and what data you accept to share with it. Hotels are the clearest case (see how AI agents book hotel rooms), but any business with online enquiries is concerned.

How do you put the policy in place?

Keep it to one page, have every employee read and sign it, and name one person who owns it. Review it each time a new agent tool appears on staff phones. If you want an outside view of which AI tools already touch your data, see our AI audit for finance teams.