The short version: Meta’s Muse for Small Business, launched September 29 in the US and Canada, promises that “nothing publishes, sends, or spends without your approval.” Meta’s own security write-up shows what that approval actually is: a permission that can be granted one time, for a session, for a task, for a set period, or permanently. Two safeguards sit underneath it. Purchases prompt you with the exact details every time, and any task that touches outside content, such as a customer’s email, loses its automatic approval and has to ask again. The size of the yes you pick on day one decides how much of your week Muse can actually take off your hands, and how much it can do without you looking.
Muse is free with usage limits. Meta’s subscription page, read on September 30, lists a Power plan at $20 a month with 500 million Muse tokens a week and a Maximum plan at $100 a month with 3 billion.
What can Muse for Small Business do today?
Meta’s launch post describes an agent that works inside the tools a small business already pays for. It connects to Instagram professional analytics, Facebook Pages and Meta ad accounts, and to Asana, Box, Canva, Dropbox, Figma, Granola, HighLevel, Intuit QuickBooks, Klaviyo, Lovable, Notion, Shopify, Slack, Stripe and Zoom. You can also build a custom connector for a service Meta does not support yet.
The jobs Meta lists are the ones that eat an owner’s evenings: reading sales, campaign and social numbers together, flagging emails that need an answer, drafting campaigns and first drafts of customer replies, and reviewing the books for unusual expenses. Meta says Muse arrives already knowing “what you sell, what your brand sounds like, and what customers keep asking you about,” because it reads that from your Instagram and Facebook business accounts.
The owner Meta chose to feature, Tom Mulholland of Mulholland Grocery, put the case plainly in the launch post: “I work about 65 hours a week.” Hours come back only if Muse is allowed to do things, and every allowance is a decision.
What does “without your approval” actually mean in Muse?
The detail is in a September 8 post on Meta’s research blog about how Muse is secured, written by Tarek Sheasha of Meta Superintelligence Labs. Muse does not grant itself anything. It proposes an action, and a separate service Meta calls Sentinel decides whether it needs your approval and which kinds of approval to offer you.
The post lists five: one-time, session-scoped, task-scoped, time-bounded and perpetual. Sentinel chooses which of those appear for a given action, and it then checks that later actions match the scope you granted exactly. So the approval prompt is not a single yes or no. It is a question about how far your yes reaches.
That is a sensible design, and it is also where the promise in the launch post becomes your responsibility. A one-time yes on a customer reply means you read every reply. A perpetual yes means you read the first one. Both are “your approval.”
Two more safeguards are worth knowing, and both are good news. Meta’s post says that when Muse reaches a checkout page where your payment details are saved, it asks for approval “with the exact details of the purchase every time.” And Meta’s help page on connectors says many connectors can be set to read-only, so Muse can look without acting at all.
What happens when a customer’s message is part of the task?
This is the part of the design that deserves the most attention, and the launch post does not mention it. Meta’s security post says Muse tracks where data came from. Content that arrives from outside, from an email, a web page or a message, is marked as untrusted. Then: “Tainted or unverifiable processes lose auto-allow and fall back to the normal approval flow.”
In plain terms, a standing yes does not carry over to a task that has a stranger’s words in it. If you gave Muse permanent permission to post to your own Slack, and a task involves text from a customer’s email, Muse has to ask you again.
That rule targets the same kind of attack as SalesBleed, where a stranger typed instructions into a public Salesforce form and a company’s own AI agent later acted on them. We covered how that happened in contact form prompt injection. Meta is not claiming the problem is solved. The same post says “prompt injection remains an open problem in the industry,” and that Muse “will sometimes make mistakes.” That candor tells you the approval prompt is a real safety layer, not a formality.
How should a small business set up Muse permissions?
Take a common shape: a three-person shop that sells on Shopify, keeps its books in QuickBooks, takes payments through Stripe and gets most of its customers from Instagram. A setup that gets hours back in week one without handing over anything you would regret:
Money tools start read-only. Connect QuickBooks and Stripe so Muse can review expenses and flag the odd charge, but set those connectors to read-only where the help page says you can. Reviewing the books is the time saver; changing them can wait.
Anything a customer will see gets a one-time yes. Replies, posts and campaign sends go out one approval at a time for the first few weeks. Muse still does the drafting, which is where the hours are. You spend seconds reading instead of minutes writing.
Batch work gets a task-sized yes. When Muse offers task-scoped approval on a job like drafting this week’s ten product posts, that is the natural fit: the permission ends when the job does.
Save perpetual for internal, reversible actions. Adding a task to your own Asana, filing a note in Notion, posting a summary to your own Slack. If a mistake there costs you a delete, a standing yes is reasonable. If it costs you a customer, it is not.
What does Muse remember after you disconnect a tool?
More than you might expect. Meta’s connector help page says disconnecting stops the data exchange, but “information that Muse previously used to perform tasks with that Connector might still remain in Muse’s memories and your conversation history.” You can ask Muse to forget. The security post adds that your files and Muse’s memory about you sit in your own isolated environment and “can be inspected, edited and downloaded freely.”
So if you connect QuickBooks for a trial and change your mind, disconnecting is step one. Asking Muse to forget what it learned from your books is step two.
Muse is not the only agent asking for a seat inside a seller’s tools this month. Amazon’s approach, where every change waits for your approval, is in Amazon Seller Assistant for Claude, and how Muse pays when it shops is in Meta Muse checkout. Meta’s design is the more flexible of the two, which is what makes Muse useful and why the first setup deserves ten careful minutes.
Frequently Asked Questions
Is Meta Muse for Small Business free?
Yes, with usage limits. Meta says Muse is free for most of what people need in the US and Canada. Its subscription page lists a Power plan at $20 a month with 500 million Muse tokens a week and a Maximum plan at $100 a month with 3 billion, checked on September 30, 2026.
Can Muse send emails or spend money without asking?
By default, no. Meta says nothing publishes, sends or spends without your approval, and purchases prompt you with the exact details every time. But approvals can be granted one time, for a session, for a task, for a set period or permanently, so what Muse can do on its own depends on the permissions you choose.
What apps does Muse for Small Business connect to?
Meta lists Instagram professional accounts, Facebook Pages and Meta ad accounts, plus Asana, Box, Canva, Dropbox, Figma, Granola, HighLevel, Intuit QuickBooks, Klaviyo, Lovable, Notion, Shopify, Slack, Stripe and Zoom. Owners can also build custom connectors for services Meta does not support yet.
Does disconnecting a tool delete what Muse learned from it?
Not automatically. Meta’s help page says information Muse used with a connector may remain in its memories and your conversation history after you disconnect. You can ask Muse to forget it, and Meta says your Muse memory can be inspected, edited and downloaded.
If you connect Muse to your business, which job would you trust it with first, and which one would you keep a one-time yes on for good? Tell us in the comments.
