How Much Access Should You Give Your AI Agent?

The rule for how much access to give an AI agent is one phrase: least privilege — the minimum access needed for the job, granted for the shortest time, and never more. That single habit protects you from almost every agent horror story, because most of them aren't about a bad model; they're about an agent that could do too much.

Why "give it everything" is the default mistake

When you connect an agent to your accounts, the easy path is to approve every permission it asks for. That's the exact instinct to fight. An agent with access to your entire inbox, calendar, and files is a single confused instruction away from acting on the wrong thing.

Security teams have landed on the same answer from both directions. Microsoft's guidance is to treat every agent as a first-class principal: give it a lifecycle-managed identity, assign explicit roles, and scope its permissions tightly against a preconfigured tools manifest. Forbes' practical brakes put it in plain terms — scoped, time-limited permissions, human approval for irreversible actions, and a sandbox first.

The mental model that makes all of it click: your agent is an employee, not an extension of you. You wouldn't hand a new hire your house key, your banking app, and a blank check on day one. You'd give them the one drawer they need and expand it as they earn trust.

The access checklist: grant, restrict, deny

Run every permission through these three buckets:

Grant (safe by default)

• Read access to tools you'll actually use — calendar, inbox, notes.
• Searching the web and reading public pages.
• Creating new drafts, notes, or files in a specific folder.

Restrict (needs a rule or a cap)

• The ability to send anything — email, messages, posts — so it asks before it goes out.
• Any spending, even small, capped at a set limit.
• Modifying or deleting existing files, scoped to one folder.
• Running commands or code on your machine, restricted to a directory.

Deny (almost always)

• Access to passwords, banking, and payment credentials.
• Your full contact list without a clear reason.
• Broad access to every account — the kind that "works with all your apps." Read-only where you can, scoped where you can't.

A simple three-question test

Before you approve any single permission, ask:

1. Does this task need it? If the agent is only reading your email, it doesn't need write access to your drive.
2. Can I cap it? Time-limited, amount-capped, or folder-scoped beats "forever" and "everything."
3. Can I undo it? If an action is irreversible, the agent should stop and ask first.

This is also where a local-first agent earns its keep: the permissions live on your machine, where you can see and change them, and your data doesn't have to cross the internet to be useful. Compare that to a cloud agent, where the access is real but the audit trail is someone else's responsibility.

Which agent access to grant, restrict, or deny

Download the agent permissions checklistagent-permissions-checklist.zip · ZIP

The takeaway

The correct amount of access is the smallest amount that still gets the job done. Start narrow, expand as you trust, and always make consequential actions ask for your sign-off. If you set that up once, your agent becomes genuinely useful without becoming a liability — which, given where agent accountability is today, is exactly the trade you want.

Want the habit nailed down? Here's how to grant your agent tools the safe way, and what getting started looks like.