Give an AI agent one job, the smallest useful set of tools, and a clear point where it must stop for you. A tool that summarizes one folder should not also be able to search the whole drive, send messages, change sharing, or delete files.
This is more than a tidy account setting. OWASP describes excessive agency as a combination of unnecessary tool functions, downstream permissions, or autonomy. A mistaken instruction and a malicious instruction can use the same legitimate access. The permission boundary has to hold even when the model is wrong.
Write the job before you connect anything
Describe the expected outcome without naming every capability the product offers. Then fill in a six-line permission plan. If you cannot state the boundary, the agent is not ready for the account.
| Decision | Write down | Example |
|---|---|---|
| Outcome | The finished result | A draft summary of new messages |
| Tools | Only the apps needed | Email and one staging document |
| Data boundary | The accounts, folders, labels, or records it may touch | Messages with the Project North label |
| Allowed actions | Read, create, edit, send, share, delete, or purchase | Read messages; create a private draft |
| Approval point | What must pause for review | Any external message or sharing change |
| Stop and expiry | When the run halts and access ends | Stop on an unknown recipient; disconnect Friday |
Do not confuse access with an approval prompt
Products often put several different controls under words such as permission, access, or approval. They are not interchangeable.
| Control | What it changes | What it does not prove |
|---|---|---|
| Connection grant | What the app or integration can reach in the connected service | That every allowed action will require a prompt |
| Action control | Which read or write actions the agent is allowed to use, when the product offers this control | That the underlying connection has been revoked |
| Approval setting | When the agent asks before using access it already has | That the app has less access to the connected service |
| Disconnect or revoke | Ends the connection or credential used for future access | That previously copied or exported data was erased |
OpenAI's current Apps in ChatGPT guidance makes this distinction explicit: its app-permission setting controls when ChatGPT asks, not the access granted when the app was connected. To remove that access, disconnect the app or have a workspace administrator disable it. Treat a confirmation preference as a brake, not as a smaller key.
Choose the smallest setup that can finish the job
- Connect only the required tool. Do not leave a general browser, shell, mailbox, drive, calendar, and payment tool available because one might be useful later.
- Start read-only. Add write access only when the outcome actually requires a change. Reading a mailbox does not require sending or deleting mail.
- Narrow the data boundary. Prefer one folder, label, calendar, repository, table, or project over the whole account.
- Use a separate identity when possible. A dedicated low-privilege account or workspace makes the boundary visible and easier to revoke. Do not give an agent an owner or administrator login for an ordinary task.
- Make the output reversible. Draft before send, stage before publish, quarantine before delete, and prepare a cart before purchase.
- Require approval for consequences. Pause before external communication, deletion, sharing or permission changes, purchases, refunds, credential creation, and other hard-to-reverse actions.
- Set destinations and stop conditions. An allowed action is safer when its recipients, domains, folders, amounts, and time window are also constrained.
Do not rely on the model to remember these limits from a prompt when the connected service can enforce them. OWASP recommends enforcing authorization in the downstream system and requiring human approval for high-impact actions. The prompt-injection guide explains why instructions found inside email, documents, and webpages should not be trusted as new authority.
If the product asks for one broad bundle
Some integrations do not offer the narrow scope a job deserves. That is a product limitation, not a reason to click through. Use a dedicated account with only the needed material, share one staging folder, export a copy for the agent, or complete the job without connecting the service. Never paste a password, recovery code, authenticator seed, or owner credential into the conversation to work around a poor connection flow.
If the connection screen adds a new permission you cannot explain from the written job, stop. Check the app's official capability and privacy pages, then decide whether the extra access is acceptable. Urgency does not make an unrelated scope necessary.
Test the boundary with harmless data
- Create a temporary folder, draft, or test record with no sensitive data.
- Run the smallest normal task and confirm the agent can reach only the intended material.
- Ask for a harmless action outside the plan, such as reading a different test folder or sending a draft to a test address. The system should refuse, omit the action, or pause at the control you set.
- Check the destination and activity log. A polished answer is not evidence that the right account, file, or recipient was used.
Do not use live payments, real customer records, private mail, or permanent deletion as test data. When a safe boundary test fails, remove the connection and fix the permission model before retrying.
Read the approval card like a transaction
Before allowing an action, check the connected app, action, target, data leaving the account, and whether the result can be undone. Expand details when the interface offers them. Deny the request if a recipient, amount, filename, URL, sharing level, or new permission differs from the plan.
A prompt that appears repeatedly can train people to approve on reflex. Do not switch to an always-allow option just to quiet an unexplained request. Reduce the workflow, split read from write, or move the approval to the connected service.
Know where to disconnect
| Product | Start here | Important distinction |
|---|---|---|
| ChatGPT | Profile menu → Settings → Apps; open the connected app to review its preferences or disconnect it. | Ask-permission choices control confirmation timing. They do not reduce the app's existing connection grant. |
| Gemini | Gemini menu → Settings & help → Connected Apps; turn off the app you no longer want connected. | Available apps and actions vary by device, country, account, and Gemini surface. |
| Another agent | Use the agent's connections page, then inspect the connected service's third-party access or security page. | Disconnecting the agent may not erase data it already copied, and deleting a chat is not the same as revoking a connection. |
Close the loop after the job
- Disconnect tools that are no longer needed. For a recurring workflow, record an owner and the next review date instead of leaving an anonymous connection.
- Check the service that supplied the access. Review its connected-app, third-party access, token, or account-security page. Revoke the grant there too when the agent's status is unclear.
- Review recent activity. Look for unexpected recipients, exports, edits, shares, purchases, or access outside the planned window.
- Remove leftover credentials. Revoke a personal access token or API key created for the task. If a password or recovery secret was exposed, replace it through the provider's official security flow.
- Keep the plan, not the access. Save the six-line job definition so a later run can be authorized deliberately.
The goal is not to make an agent harmless. A useful agent needs real capability. The goal is to make its maximum mistake smaller than the account, business, or person it is helping.
