Book a call

← Blog

By Tom Cobb
TipsAI Agents

AI Agent Permissions: What "Don't Ask Again" Gets Wrong

This week's Claude Code "don't ask again" leak and Databricks' new Genie show why AI agent permissions matter. A plain setup for small businesses and ecommerce stores: own accounts, three buckets of actions, no passwords in chat, money limits and a monthly review.

Flat illustration of a small robot assistant in front of three doors, one open, one locked and one marked with a checkmark, on a navy background.

If you use AI tools you've probably clicked "always allow" at some point. I do it too. The agent asks for the fifth time if it can run the same thing, you're busy, you click the button. This week that exact button was in the news, so if you run a small business or an online store and you've got agents doing real work, it's worth ten minutes. What it comes down to is AI agent permissions: what the agent can do on its own, what it has to check with you on, and what it should never touch.

The Claude Code story

Claude Code is Anthropic's coding agent. Before it runs a command on your computer it asks you first, and one of the answers is "Yes, and don't ask again." If you pick that one it saves the command in a small settings file in your project so it can run it without asking next time. Sometimes it saves the whole command word for word. So if there was a password or an API key in that command, now there's a password in that file, in plain text.

On November 5, 2026 a security company called Apiiro searched public GitHub for that file. They found 104,185 copies. 1,122 of them had at least one real secret, 1,379 secrets total, things like database passwords, cloud keys and SSH logins (The Hacker News, Nov 7, 2026). The file is supposed to stay on your laptop, but Claude Code only keeps it out of git with a setting on that one machine, so it slips into shared code pretty easily (GitLab, Nov 2026). By November 9 people on X were all talking about it.

The bug isn't really what I care about here though. The button is.

If you don't write code

You still have the same problem anywhere you give an agent a login and a permanent yes. Say an agent answers customer emails for your Shopify store. Week one you check every refund. Week three you tell it to just go ahead. Now it can refund anyone, any amount, and you never actually decided that. Or you pasted your supplier portal password into a chat so it could check stock, and that password is now in a chat log you don't control.

Use agents, I do every day. Just treat the permissions like you'd treat handing keys to a new employee.

Same week, different company: on November 11 Databricks launched a new version of its Genie agent. It runs as the user and only sees what that person can see. Admins pick which tools it can use and which actions need approval. Everything gets logged, and you can set budgets and spending caps per user (Databricks, Nov 11, 2026). Their docs say the budget is a near real time estimate, not a hard cap on the bill (Databricks docs). You can copy the idea without buying anything.

How I'd set AI agent permissions

Give each agent its own account. Not yours. Make it a separate user in Shopify, Gmail or your helpdesk with only the access that job needs. If it goes wrong you turn off one account, and the logs show what the agent did versus what you did.

Make three lists. What it does alone: order status questions, tracking links, tagging tickets. What it asks you first: refunds over an amount you choose, discount codes, address changes after shipping. What it never does: change prices, delete products, touch payouts or bank details. One page is plenty. Then set up the tool to match.

When you approve something, approve the type of action ("send tracking emails"), not one exact command with your info in it. That's the researchers' advice, and it's what would have kept those passwords out of the file.

Don't paste passwords or API keys into an agent chat. Connect the tool with its own login or a proper connector, or keep the secret in a password manager or environment variable so the agent only sees the name (The Hacker News).

Anything that can spend money, refund or place orders gets a limit per action and per month, and if your platform can't do limits then money stays in the ask first pile. Keep in mind an alert isn't a hard stop, Databricks says as much about its own product.

And once a month, open up whatever list of "always allow" approvals your tools keep and actually read it. Delete anything you don't remember saying yes to. Ten minutes, maybe less, and it's the step that would have caught most of those 1,122 files.

Quebec owners

If you're in Quebec, the private sector privacy law that Law 25 updated already says you have to limit access to customers' personal information to people who need it for their job (Commission d'accès à l'information). An agent running on your full admin login doesn't really fit with that. One account per agent, small access, and a log makes it a lot easier to show you took it seriously, but I'm not a lawyer so run your own situation by one.

Where to start

If you've already got an agent running, do the monthly review today and change any password you've ever pasted into a chat. If you're just getting going, pick one job, write the three piles and build out from there. I go through picking that first job in AI agents for small business, and there's more on one agent versus several too. Setting up permissions and approvals is a big part of the work I do on AI agents for small businesses if you'd rather not do it alone.

Want a second pair of eyes on your agent setup? Book a call with me.

Sources

don't be a stranger

— get in touch...