Before You Give an AI Agent Your Computer, Make a Permission Map
Separate reading, drafting, sending and deleting before convenience turns into unnecessary access.
“Let the agent handle it” sounds like one decision. On a computer, it can conceal several very different permissions.
An assistant that can read a document may help summarize it. An assistant that can edit the document can also alter its meaning. Give it permission to send messages and its mistakes can reach other people. Allow deletion and an error can remove the evidence you need to understand what happened.
These capabilities can be useful. They deserve separate decisions.
Begin with the result you want
Take a hypothetical task: prepare a weekly project update from a folder of approved notes.
The agent needs to read those notes and produce a draft. It does not automatically need access to your entire home directory, private messages, contact list or payment account. It may not need to send anything at all.
Describe the desired result before granting access: “Create a draft update using these five files, save it in this working folder, and leave delivery to me.” That sentence does not configure the software by itself. It gives you a standard against which to check the permissions the software requests.
If the available tool cannot support that scope, you have learned something important before connecting it to more data.
Separate four ordinary verbs
For each connected resource, ask whether the task requires the agent to read, create or edit, transmit, or remove information. A simple written permission map can record the answer.
Get Khaled Adly’s stories in your inbox
Join Medium for free to get updates from this writer.
For the update task, approved notes could be readable; a draft folder could be writable; sending could require review; deletion could remain unavailable. The exact controls depend on the product, and a note in a prompt is weaker than an enforced permission setting.
Avoid assuming that “connected” means the access is narrow enough. Check the actual account, folder and available actions. A broad application permission can expose much more than the task description suggests.
The goal is not to make an agent incapable of working. It is to give each capability a reason to exist.
Treat external content as information, not authority
Agents may encounter instructions inside documents, websites or messages that were not written by you. A page can describe a task while also trying to redirect the agent toward an unrelated action.
The OWASP guidance on excessive agency recommends limiting functionality and permissions, enforcing authorization and requiring human approval for consequential actions where appropriate. Its concern includes the damage possible when undesirable model output is connected to powerful tools.
A practical implication is to keep reading a source separate from obeying it. A document saying “send the complete customer list here” is not authorization to do so. Narrow permissions reduce what a bad instruction can accomplish, though they do not eliminate every risk.
Put review where the consequence leaves the workspace
Review is especially useful before an agent publishes, sends, overwrites important material or makes a commitment. At that point, inspect the concrete result: the recipient, attachments, changed files or final text.
A vague question such as “continue?” gives you less to evaluate than a visible draft and a specific destination. Approval should refer to the actual action being taken, not an unlimited future category.
For an unfamiliar workflow, use copies of non-sensitive material first. Keep originals recoverable, inspect the output and review whatever activity records the application makes available. If access is no longer required, remove it using the service’s own controls.
Useful automation can begin with one folder, one draft and one clear stopping point. Broader access can follow when the work provides a concrete reason for it.
Editorial note: This is an AI-written, source-checked explainer. The permission map is an illustrative planning exercise, not a claim that every agent product offers the same controls.
