Meta’s Muse launched in the US on September 8, 2026, and it can read and send email on a person’s behalf. Canadian teams should write a personal AI agent policy before staff start connecting work accounts to tools like it.
- Meta says Muse can connect to email, calendars, shopping and payments, and keeps working after the app is closed.
- At launch it is rolling out in the US only. That gives Canadian employers a window to decide the rules first.
- The policy fits on one page: which work accounts may be connected, who approves, and what the agent may send.
Picture a sales coordinator on a Monday morning who asks a personal agent on her phone to chase three overdue quotes. The agent opens her work inbox, drafts the follow-ups and, if she allowed it, sends them. Nobody in the company chose that tool, and nobody knows which client emails it has read.
That situation got closer on September 8, 2026, when Meta introduced Muse, a free personal AI agent that “can work on a person’s behalf across the apps they use daily.” Meta says it is rolling out in the US first. Canadian employers have a little time, and we would spend it on a short written rule. Under PIPEDA, your company stays accountable for personal information an agent reads or sends on its behalf.
Key points
- What can Muse actually do with a work account? According to Meta, Muse can send email, book travel, fill out forms and make purchases, and it keeps working after the person closes the app.
- Who should approve a personal agent on work email? The person who already approves new software for your team should approve this too, whether that is an IT lead, the office administrator or the owner.
- What goes in a one-page personal AI agent policy? Four lines cover most small and mid-sized teams: which accounts staff may connect, who approves anything beyond personal use, what the agent may never do on a work account, and how someone reports a mistake the agent made.
What can Muse actually do with a work account?
According to Meta, Muse can send email, book travel, fill out forms and make purchases, and it keeps working after the person closes the app. People choose which apps it connects to and, for email, whether it only reads or can also send.
Meta says Muse asks before sensitive actions such as sending an email or buying something, and keeps an audit trail of what it has done. These are vendor claims; we have not tested the product, and it was not available in Canada at launch.
The controls Meta describes all sit with the individual user. None of them is a company setting. If an employee connects a work inbox, the employer has no view into that choice unless its email system blocks or logs the connection.
Who should approve a personal agent on work email?
The person who already approves new software for your team should approve this too, whether that is an IT lead, the office administrator or the owner. A personal agent with send access to a work inbox is a new user of company systems, and it should go through the same approval as any app that asks for those permissions.
In practice the decision splits into three levels. We would write them down like this:
- Personal accounts only Example: Personal email, home calendar; Who approves: The employee; Our default: Allowed
- Read access to work accounts Example: Summarizing the work inbox; Who approves: IT lead or owner; Our default: Case by case, logged
- Send or buy on work accounts Example: Replying to clients, paying suppliers; Who approves: IT lead and the budget holder; Our default: Not allowed until reviewed
The defaults are our suggestion. Adjust them to your own risk and your clients’ contracts (some client agreements limit where their information may be processed).
What goes in a one-page personal AI agent policy?
Four lines cover most small and mid-sized teams: which accounts staff may connect, who approves anything beyond personal use, what the agent may never do on a work account, and how someone reports a mistake the agent made. Keep it short enough that people read it.
Canadian privacy law still applies when the person doing the processing is an agent. If client personal information leaves your systems through a personal tool, your organization is still accountable for it. Our shadow AI column covered why tools staff adopt on their own are the hardest to see. And the approval habit we described for Slack Code agents carries straight over: someone named signs off before an agent acts on company systems.
When an agent does send the wrong email, the plan from our AI outage plan column helps: one owner, one channel, one manual fallback.
What would change our view
If Microsoft 365 and Google Workspace shipped admin controls that let a company see and approve each personal agent connected to a work account, the written policy would matter less, because the setting would enforce it. We would also relax the send rule if Meta published independent testing of Muse’s approval prompts on real work email.
Try This Week
- Task: check whether any personal AI agent already has access to a work account.
- Owner: whoever administers your Microsoft 365 or Google Workspace.
- Metric: number of third-party apps with mail read or send permission.
- Baseline: open the admin console’s connected-apps list today and count them.
- Threshold: every app on the list has a named approver.
- Deadline: Friday, September 11.
For the wider picture on running AI at work, see AI in Business and our AI for business guide.
Browser assistants belong in the same policy; see our guide to Gemini in Chrome at work.
Money is the hardest line to draw; read what Canadian bank terms say about giving an agent your login.
FAQ
Is Meta Muse available in Canada?
It was not available in Canada at launch. Meta said on September 8, 2026, that Muse was rolling out in the US on iOS, Android and muse.ai.
Can Muse send email for me?
Meta says it can, if the person grants send access, and that it asks for approval before sending an email or making a purchase.
What should a personal AI agent policy cover?
Which work accounts staff may connect, who approves access beyond personal use, what the agent may never do on work accounts, and how mistakes are reported.
