Give an AI agent the smallest set of permissions that lets it finish the task, and nothing more. In practice that means a separate account for the agent rather than your own login, read-only access wherever possible, access to specific folders or mailboxes instead of everything, spending and sending limits, approval for irreversible actions, and a tested way to revoke access in minutes. This principle, called least privilege, has protected computer systems for decades and matters even more when the user is software that can be confused or tricked.
The temptation is understandable. Connecting an agent to your main email and drive with one click is easy, and narrow permissions take effort to set up. But an agent with your full access can do anything you can do, including mistakes you would never make. A few hours of setup up front is far cheaper than cleaning up after a misdirected email to every customer or a deleted shared folder.
Why permissions matter more for agents than for people
When a person has access to a system, several things limit the damage they can do: they get tired, they notice when something looks odd, and they hesitate before deleting a folder called “Contracts 2025”. An agent has none of these brakes. It can perform hundreds of actions in minutes and will follow instructions that look strange to a human.
Agents can also be misled. They read emails, web pages and documents as part of their work, and some of that content may contain text designed to give them new instructions. The more an agent is allowed to do, the more an attacker gains if they succeed in steering it.
Mistakes scale differently too. A staff member who misunderstands a task usually gets one or two items wrong before someone notices. An agent that misunderstands applies the same error to every item in the batch. Narrow permissions turn a potential disaster into a contained annoyance.
Finally, permissions are what make an agent’s actions traceable. If it works under its own account, every change carries its name in system logs. If it works under your login, its actions and yours are mixed, and investigating a problem becomes guesswork.
Practical rules for setting up access
Create a dedicated account for the agent. Use a separate user or service account with a clear name, not your personal login. This makes its actions visible and easy to switch off.
Start with read-only. Many useful tasks, such as summarising, comparing and monitoring, need only read access. Add write access later and only where needed.
Scope access to specific places. Grant one mailbox label, one folder or one project, not the whole drive or every inbox.
Prefer drafts over sends. Let the agent create drafts, proposed changes or pending orders that a person approves.
Set hard limits. Cap the number of emails per day, the value of any purchase, and the total spending on paid services the agent can call.
Avoid sharing master passwords. Use the connection methods the software offers, such as authorised app access, that can be limited and revoked. Never paste an admin password into an agent’s instructions.
Protect the accounts the agent uses. Turn on two-factor authentication for the human owners and keep the agent account’s credentials in a password manager.
Separate test from real. Try the agent on a copy of your data or a test environment before connecting it to live systems.
Review permissions regularly. Every few months, check what each agent can access and remove anything no longer needed.
Permission levels and when to use them
Move up a level only when a task genuinely needs it and you have a record of reliable behaviour.
| Level | What the agent can do | Suitable for |
|---|---|---|
| Read only | View files, emails or records; produce summaries and reports | Research, monitoring, data extraction, first pilots |
| Create drafts | Write new drafts or proposals that a person must approve | Customer replies, documents, social posts, purchase suggestions |
| Write within limits | Create or update records, send a capped number of messages | Routine updates after weeks of reliable drafts |
| Act with approval | Perform sensitive actions only after a person confirms each one | Orders, scheduled sends, changes to public pages |
| Full access | Do anything the account can do | Rarely justified; avoid for business data |
How to revoke access quickly
Practise this before you need it, not during an incident.
- Know where every connection lives. Keep a simple list: agent name, what it connects to, which account, who set it up.
- Find the “connected apps” page for each service. Email, cloud drives and many business tools have a page listing authorised apps. Bookmark them.
- Disable the agent’s account or token. Switching off its dedicated account stops everything at once, which is why a separate account matters.
- Change any shared secrets. If keys or passwords were stored where the agent could read them, replace them.
- Check the logs for what happened. Review recent actions under the agent’s account to see what needs undoing.
- Record what you learned. Update the setup so the same problem cannot recur.
A worked example: an agent that reads supplier invoices
A wholesale shop in Can Tho wants an agent to read supplier invoices that arrive by email and enter totals, dates and supplier names into a spreadsheet. The quick setup would connect the agent to the owner’s mailbox and the whole company drive. The careful setup takes an extra afternoon.
First, suppliers are asked to send invoices to a dedicated address, or a mail rule forwards them into one label. The agent gets read access to that label only. Second, the agent gets edit access to a single spreadsheet, not the drive, and cannot delete rows. Third, any invoice it cannot read clearly is listed for a person to check rather than guessed. The agent cannot send email at all.
If something goes wrong, for example a fake “invoice” containing odd instructions, the worst the agent can do is add a wrong row to one sheet, which the weekly check catches. Compare that with an agent holding the owner’s full mailbox: the same fake email could lead it to forward private messages or reply to customers. The extra afternoon buys a very different worst case.
Frequently asked questions
Is it safe to connect an AI agent to my main email?
It is risky if the agent gets full access to read and send. Prefer a dedicated mailbox or label, read-only access, and drafts instead of direct sending, especially at the start.
What is a service account?
It is an account created for software rather than a person, with its own limited permissions. Using one for an agent separates its actions from yours and lets you switch it off without affecting staff.
Can I give the agent my password just for one task?
Avoid it. Passwords pasted into instructions may be stored in logs or memory and reused later. Use authorised connections that can be limited and revoked instead.
How often should agent permissions be reviewed?
At least every few months, and whenever the task changes, a staff member who set it up leaves, or the agent behaves unexpectedly.
Does least privilege slow the agent down?
Sometimes it adds an approval step, which costs a little time. That cost is small compared with the time needed to recover from a wrong mass email or deleted files.
Who in a small company should own agent access?
One named person, often whoever manages IT or the owner, should approve new connections and keep the list of what each agent can reach. Shared ownership usually means no ownership.
