Generative AI Security: Best Practices and Audits for SMEs

Four risks come up most often with generative AI in small businesses: a prompt pasted without thinking into a consumer-grade tool, an agent connected to internal systems with rights that are too broad, an API key left in generated code, and no traceability of what an agent actually did. None of these require a dedicated security team, but all of them need to be identified before an incident, not after.

What are the security risks specific to generative AI in business?

These risks are not hypothetical: they come from how a generative AI tool gets used day to day, usually with no bad intent at all.

• Data leaking through a prompt. Pasting a contract extract, a customer list or personal data into a consumer-grade tool not governed by company policy takes that data outside the usual boundary, with no guarantee about how it will be used afterwards.
• Poorly scoped access for a connected agent. An agent wired into an internal system (inbox, CRM, database) often inherits the rights of the account that connected it, broader than what its task actually requires.
• Secrets exposed in generated code. An AI writing code will readily place an API key in plain text in a configuration file, a point covered in GitHub and .gitignore: never expose your API keys with generative AI.
• No traceability of an agent's actions. Without a log of actions taken, there is no way to know afterwards what an agent actually read, changed or sent.

How do you scope an AI agent's rights to the strict minimum?

The principle of least privilege means granting an agent only the rights indispensable to its task, never more for the sake of convenience. An agent that has to summarise support tickets needs no write access to the customer database, nor access to the management team's inbox. This scoping runs through the authorisation mechanisms covered in our foundational article, databases, OAuth, API keys: what you need to understand before coding with AI: scoped OAuth tokens (read-only where possible), a dedicated API key per integration rather than a single shared key, and row-level security rules on the database as soon as several agents access the same table.

Why keep a human in the loop on high-stakes actions?

An agent that reads and summarises does not carry the same risk as an agent that sends an email, changes a customer record or triggers a payment. On these high-stakes actions, human validation before execution remains the most reliable safeguard: configure the agent to propose the action and wait for confirmation, rather than executing it directly, whenever a mistake would be costly to fix.

How do you regularly audit access and active keys?

An AI security audit for an SME comes down to a periodic review of three simple lists, with no complex tooling required.

1. AI tools connected to company systems: which accounts, agents or integrations have active access to your inbox, CRM, files or database.
2. Active API keys: when they were created, when they were last used, and whether they still map to a real use.
3. Rights granted to each agent: whether its access level still matches the task it was configured for, particularly after a change of project or provider.

ANSSI, France's national cybersecurity agency, publishes security recommendations dedicated to generative AI systems, a useful reference for building this review. A quarterly rhythm is enough for most organisations, tightening the frequency if new agents are added regularly.

How do you raise awareness among teams without blocking AI use?

Banning generative AI pushes teams to use it anyway, outside any framework, on personal accounts and with no traceability: that is the worst outcome. The simple rule to repeat: never paste sensitive data (customer, financial, HR, contractual) into a consumer-grade tool not governed by company policy, and favour tools approved internally, drawing on guidance such as the CNIL's, France's data protection authority, page on artificial intelligence.

In practice, what security settings should you know for each AI tool?

Claude (Claude Code, Claude Cowork)

Claude Code asks for confirmation before sensitive actions (writing files, running system commands) and lets you restrict the tools and permissions granted to a project. A skill or a hook can also systematically block a given action, such as a direct git push, until a human has approved it.

ChatGPT and Codex

Codex can create, modify and push code to a connected repository: check the integration's permissions (read-only or write, which repositories) before connecting it to a sensitive project. For everyday ChatGPT use, keep the company's business account, with its own privacy settings, separate from a personal free account, which should never handle company data.

Antigravity (Google's IDE agent)

Antigravity works with potential access to the terminal, files and Git in the development environment. The key precaution is systematically reviewing proposed commands before approving them, particularly anything touching credentials or a remote repository, and limiting which folders the agent can actually reach.

None of these settings replace a regular audit: they are safeguards at the moment of action, while the audit remains the way to check afterwards that nothing has drifted.