Before You Give an AI the Keys

When you connect an AI agent to your email, your files, your calendar, or your money, you're not just asking it for help once — you're handing it standing access to act there again and again, often without checking back. The thing that turns an ordinary AI mistake into real damage usually isn't the mistake itself. It's how many keys you handed over. Give few, put limits on the costly ones, and keep the power to take them back.

The one idea: an agent is only as dangerous as the access you give it. Grant the least it needs to do the job, cap the parts that cost money or reach other people, and keep a fast way to revoke it.

Why access is the real risk

A clever assistant that can only suggest is nearly harmless. The risk arrives the moment it can do — and scales with how much you let it reach.

Standing access isn't a one-time task

Once it's connected, it can act whenever — not just on the thing you asked. A misunderstanding can repeat, or run while you're asleep. You're not approving one action; you're granting an open door.

Breadth multiplies the damage

An agent with your whole inbox, your entire drive, or your card on file can do wide harm from a single wrong call. One scoped to a single folder or a read-only view simply can't. Narrow access is a ceiling on how bad a mistake can get.

A third-party agent adds a third party

"Connect your account" often means handing your data to the company that makes the agent, on their servers. You're trusting not just the AI but its maker and their security. That's a real decision, not a checkbox to rush past.

Handed-over credentials can't be taken back

A password or a one-time code you paste in is exposed for good. A proper connection you can switch off later is not. Always prefer the kind of access you can revoke over the kind you can't.

Set it up safely

Going through this once, before you connect anything that matters, prevents most of the trouble. Tick as you go.

Grant the narrowest access that does the job. Read-only if it only needs to read; one mailbox or folder, not everything you own. Connect in a way you can revoke — never paste a password or a 2FA/OTP code into an agent. Use the official "connect" / sign-in flow that you can switch off later. Cap the costly parts. Set spending limits, and require your approval before it buys, pays, or sends anything to other people. Use a separate or limited account where you can — not your main admin login — so a mistake is contained. Check what it can actually reach. Read the permissions it asks for, and remove anything it doesn't truly need. Favor agents that log what they did and let you review — and undo — their actions. Keep a kill switch. Know exactly how to revoke access fast, and actually do it the moment you stop using the agent. Vet the maker. Where does your data go, can you delete it, do they have a track record? No clear answers means don't connect.

What not to hand over (without a very good reason)

Your primary bank or payment login, or your password manager.
Admin / root control of your devices or accounts — or anything at work, without permission.
Raw passwords, recovery codes, or 2FA secrets. Ever — no legitimate agent needs these.
Anything holding other people's private data that you're responsible for keeping safe.

The close

Connecting an AI to your real accounts is where it goes from clever to genuinely useful — and from harmless to risky. The protection is boring and powerful: give it the smallest set of keys that does the job, a cap on what it can spend or send, and a lock you can turn from the outside. Set that up once, and most of what could go wrong simply can't.

Free and public domain (CC0) — copy it, translate it, share it with anyone connecting AI to their accounts. No accounts, no tracking; it runs entirely in your browser, and nothing you tick is saved or sent anywhere. Practical judgment, not technical or security advice for high-risk setups.