InsightsAI Insights
AI Insights

Give your AI agent a login, not the keys: how UK teams should let agents into their website and systems

The direction of travel for AI changed again this week, and it's worth noticing.

By StJohn Krog, Founder & MD

AI Insights10 November 2026

On 9 November, Lovable said it had acquired the London-based team behind Radish AI, an agentic infrastructure start-up, and that its new London office will lead work on agents for businesses, with the aim of helping firms "automate their operations, run reliably and grow". The same day, Manchester's Matillion said its agent platform, Maia, had helped Balfour Beatty cut the time to build and roll out some data pipelines from weeks to hours (figures from Matillion itself). Its CEO put the shift neatly: the teams that win will be "the ones that can hand whole pieces of work to agents and trust what comes back."

That's the real question for UK SMEs and scale-ups now. Not "should we use AI?", but what are we going to let it touch, and how will we know it did the right thing?

Agents don't just answer. They act

A chatbot gives you words to check. An agent logs in somewhere and changes things: it edits a web page, updates a record, sends an email, moves a file. That's where the value is, and it's also where the risk is.

The UK's National Cyber Security Centre (NCSC) has been unusually clear on this. Its guidance on adopting agentic AI boils down to a short list most businesses can actually follow:

  • Least privilege. Give an agent only the access it needs, for the shortest time it needs it.
  • Limit scope. Constrain what it can reach, what actions it can take and when.
  • Avoid long-lived credentials. Prefer temporary access, and revoke elevated rights when the task is done.
  • Monitor behaviour. Watch for unusual activity across connected tools and workflows.
  • Plan for incidents, including the ability to stop an agent quickly.

The NCSC also warns about an agent's "blast radius": the wider its access, the bigger the damage if it misbehaves or is manipulated. Its advice is to restrict access to just the resources a task needs, and to watch for attempts to go further.

None of this is exotic. It's how you'd onboard a new junior colleague: a named login, a sensible role, nothing they can't undo without someone signing it off.

What "a login, not the keys" looks like in practice

The cleanest example we've seen recently comes from the Statamic ecosystem, the Laravel-based CMS that's quietly become one of the best platforms for working with AI.

The Statamic MCP addon (version 1.1.0 landed in early November) lets AI tools such as Claude, ChatGPT and Cursor read and write a Statamic 6 site's content through the Model Context Protocol (MCP), the emerging standard for connecting AI agents to software. What makes it interesting isn't that an agent can edit your website. It's how it's allowed to:

  • The token is the user. Every agent request runs as a real Statamic user, so the roles you already manage in the Control Panel decide what it can do. There's no second, hidden permission system to get wrong.
  • Agents get their own role. The addon's own example is a "blog agent" that can create and edit blog drafts, but can't publish, delete, or see any other collection.
  • Drafts by default. Creating an entry always saves a draft, and editing never changes whether something is published. Publishing is a separate action needing its own permission, so you can let an agent draft all day and still approve every publish yourself.
  • It can check its own work. The agent can open a temporary preview link to see how a draft renders before anyone puts it live.
  • Safe switches. Delete tools don't exist unless you turn them on. You can make the whole thing read-only, limit it to specific collections, set tokens to expire, and revoke a connection from the Control Panel.

Line that up against the NCSC list and it maps almost point for point: named identity, minimal role, limited scope, expiring credentials, a human on the publish button, and a kill switch.

It also explains why AI and Statamic get on so well. Statamic content is structured and stored as plain, readable files, and its blueprints can carry written instructions for each field, so an agent knows what goes where and in what tone. Add Laravel 13's first-party AI tools, which Statamic supported from day one, and you've got a platform built to work with agents rather than one with AI bolted on.

A five-step checklist before you let an agent in

Whatever your stack (a CMS, a CRM, Shopify, your project tool), the same questions apply:

  1. Name the job. "Draft product descriptions for the autumn range" is a job. "Help with the website" isn't. Narrow jobs make narrow permissions easy.
  2. Create a separate user for the agent. Never let it borrow a person's login, and never an admin account. If you can't tell agent changes from human ones in your logs, fix that first.
  3. Keep a human on the irreversible step. Publishing, sending, paying and deleting should need a person, at least until you've seen months of good behaviour.
  4. Make access expire. Time-limited tokens and a quarterly review of what each agent can reach. When a project ends, its access ends.
  5. Decide how you'd stop it. Who can revoke the connection, and how fast? Write it down before you need it.

If a tool can't support those five things, that tells you something about whether it's ready to touch your live systems.

The optimistic bit

This is good news. The tooling is maturing fast, the UK's own security agency has published sensible, plain-English guidance, and platforms like Statamic are showing that "safe" and "useful" don't have to pull against each other. Businesses that set agents up properly now will be the ones confidently handing over whole pieces of work next year, while others are still arguing about whether they can trust the output.

Why this matters for Clarity Growth

We build and run websites and connected systems for UK businesses, increasingly with AI agents working alongside the people who use them. That means we spend as much time on roles, permissions, drafts and approvals as on the AI itself: setting up agent users with the right scope on Statamic, Shopify and the tools around them, keeping a person on the publish button, and making sure every change can be traced and undone. If you want agents doing real work in your business without handing over the keys, that's exactly the kind of setup we help design.

Sources

Related services

AI & automation

Automation

Technology consultancy