What should a small business take back from an AI tool after the first 90 days?
After the first 90 days, a small business should take back every permission an AI tool has not used and nobody can justify in a sentence, treating access like a renewable lease. Using Dr. Jonah Tebaa's framework of four verbs—Look, Change, Send, and Spend—managers audit activity records to revoke unused capabilities. Illustrated by a composite case where editing a price list lingered after a single import, this routine replaces broad setup grants with term-limited permissions.
Dr. Jonah Tebaa starts from a small observation about how companies adopt AI tools: the permissions arrive before anyone understands the tool. In a composite example he uses, a 22-person building-supplies distributor in Beirut connects a scheduling and email assistant so it can read supplier messages. It is an illustrative case, not a real client. By the time the first review happens, the assistant holds eleven permissions and has used four.
The question Dr. Tebaa asks is what the business should take back. His answer is specific: everything the tool has not used in 90 days and that nobody can justify in a sentence.
Why the first grant is the widest
In his work with owners and managers, Dr. Tebaa notes that setup is the moment of greatest ignorance and greatest generosity. Nobody yet knows what the tool will need, so the comfortable choice is to approve the whole bundle. Each permission has a plausible reason: read the supplier inbox, confirm meetings in the owner's name, reach the shared drive that happens to include payroll, open the price list for a one-off import.
Afterwards the incentives run one way. Anyone who needs more access asks for it, and the request leaves a trace. Nobody asks for less, so nothing leaves a trace. The tool works, nothing breaks, and the settings screen stays closed. In Dr. Tebaa's reading, the gap between what was granted and what was used is not carelessness. It is the default result of a process that has an owner for adding access and none for removing it.
A lease instead of a gift
His framing is that access should be treated like a lease. A lease has a term, a named party and a renewal date, and nobody is surprised when it ends. Under this view, a permission is not something a business gives once. It is something the business decides again every 90 days, with the tool's own activity record on the table.
The 90-day period is deliberate. Shorter, and the record is too thin to show a pattern. Longer, and a forgotten permission can sit open for most of a year.
Four verbs for four kinds of cost
To make the review readable by non-specialists, Dr. Tebaa replaces the vendor's permission list with four verbs. Look covers reading: inboxes, drives, customer chats. Change covers editing and deleting: price lists, customer records, files. Send covers acting under the company's name: email from the owner's address, messages to customers, invitations to suppliers. Spend covers money: orders, payments, stored cards, subscriptions.
He argues the verbs matter because they price mistakes differently. A tool that reads too much has created a privacy exposure. A tool that edits too much creates an error that surfaces later, often in an invoice. A tool that sends too much speaks for the company in public. A tool that spends too much produces a number. The leash therefore shortens from Look to Spend, and the last two are granted for a stated purpose with an end date.
What the review looks like in practice
The routine he describes is short enough to run on one tool in half an hour.
- List every connected tool, including those attached through an owner's personal login.
- Write down what each can do under the four verbs, taken from the connection screen rather than from memory.
- Compare that with what the tool did in the last 90 days.
- Remove what was unused and unexplained.
- Attach one named person and one date to each tool.
- Re-grant on request, for a reason and a limited term.
In the composite case, the comparison turned up the near miss that makes the argument concrete. The permission to change the price list had been opened for a single import and never closed. Nothing had gone wrong. The review closed it, and the note beside it said it could be reopened for a named import with an end date.
Dr. Tebaa is careful about what this shows. It is a near miss caught, not a disaster, and the lesson is about timing: the cheapest moment to find a lingering permission is before it matters.
Where the method stops
He is open about its limits. Some permissions are rare for good reasons, such as a year-end export for the accountant, so an unused permission is a prompt for a question, not an automatic deletion. The review is also narrower than a security audit. It does not examine how a tool stores data or how its vendor operates, and it does not replace technical advice. What it offers is a management habit that an owner can run without specialist knowledge.
Why it matters in Lebanon and the wider region
Dr. Tebaa points to a few setups that are common in small firms across Lebanon and the region and that make the review more necessary. Business WhatsApp numbers are often held on a single person's phone. Accountants may work through a shared login. Owners frequently connect company tools to a personal email account because it was the quickest route on the day. None of these is unreasonable. Each is a place where access spreads without anyone choosing it, which makes it a good place to start.
The ask
His practical request is modest. Choose one AI tool connected to company email or a drive. Spend thirty minutes writing down what it can look at, change, send and spend. Check its activity record. Put a date 90 days out on the page, and name who will be there when it arrives.
