Scoped, Clocked, Reversible: The Access Rules Every AI Agent Should Live By

Somewhere in the last couple of years, the assistant left the chat window. It reads your inbox, drafts the reply, renames the files, books the flight, pushes the commit. The pitch decks call this agentic. Your laptop just calls it Tuesday.

The trouble is that most of these tools ship with the permission model of a new roommate: here's the key, try not to burn the place down. Full mailbox. Full drive. Browser session included. Somewhere in a settings screen there's a toggle marked Allow, and that's the whole negotiation.

That isn't a security footnote buried in a terms page. It's the product decision that determines whether you actually use the thing. An agent you're nervous about is an agent you babysit, and an agent you babysit is a slower way of doing the work yourself.

So here's a permission model that fits on a page. Four dials, ordered by how much they matter.

Dial one: scope — hand over a folder, not a filesystem

The oldest idea in IT security is the one consumers never get told about: least privilege. Give a process the minimum it needs, for the minimum time, and nothing more. Your banking app doesn't ask for your photo library. Your agent shouldn't need your entire drive to sort receipts.

Practical version: make a folder called agent-workspace, then a subfolder per job. Receipts in one, the draft newsletter in another, client contracts in a third. Point the agent at the subfolder. If the tool only accepts a root directory, that's a design flaw worth naming out loud during the trial.

The same logic applies to accounts. A dedicated address for the agent's calendar invites. A separate browser profile with no saved passwords. A read-only copy of the spreadsheet instead of the live one. None of this is exotic — it's the hygiene you already apply to a shared Google Doc.

Dial two: clock — access should expire

Almost nobody ships this, and it's the one you'll miss most. Ask a vendor how long the agent keeps its connection after you close the tab and you'll usually get a shrug. The good ones let you bound it: this session, this afternoon, this week.

The riskiest moment in any agent setup isn't the task you're running. It's the week after, when you've forgotten the token is still live and the integration still has write access to your calendar. Time-boxing turns a permanent liability into a temporary one.

If the tool won't expire access on its own, do it by hand. Revoke when the project ends. Put a fifteen-minute block on your calendar labeled "renew agent access" the way you'd schedule a password rotation. Boring, effective, and far cheaper than an incident.

Dial three: ledger — if you can't see it, it didn't happen

Visibility is the dial people skip, because logging sounds like work. It isn't. A usable activity log answers three questions: what did the agent touch, when, and what changed.

You want a scrollable history with file names, timestamps, and either a diff or a plain summary of the edit — not a wall of JSON copied out of a developer console. You want it inside the product, not behind a support ticket. And you want it to survive the session so you can check on Monday what happened on Friday.

Two tests to run while trialing. First, ask the agent to modify five files and see whether the log names all five. Second, ask it to delete one, and check whether the deletion gets the same prominence as an edit. If deletions are quieter than creations, that tells you what the vendor thinks you care about.

Pair the log with a weekly skim — five minutes, same slot as the expense review.

Dial four: kill switch — one click, and you've actually tested it

Revocation separates a real product from a stage demo. It should be one click, in the same place you granted access, and it should take effect immediately. Not within twenty-four hours. Not after the current task finishes.

Test it before you trust it. Grant access to a junk folder with three files. Run one task. Revoke. Run the task again. If the agent still completes it, you've learned something valuable and lost nothing.

The same question applies to offboarding. If the agent connects an account, disconnecting should clear stored credentials too. Ask directly. Vendors who've thought about it answer in one sentence; vendors who haven't send you a link to the privacy policy.

Six questions for your next vendor call

Record the answers, then compare them against what the trial actually does.

• Can I scope access to a single folder or mail label rather than a whole account?
• Does access expire automatically, and can I set the window myself?
• Can I read a plain-language log of every action, deletions included?
• Is revocation instant, and does it wipe stored credentials?
• Is my content used for training by default, and where's the opt-out?
• If I delete my account, what happens to the files the agent created?

A vendor who can't answer the log question during a live trial hasn't built the thing you're being sold.

The goal isn't suspicion

Nobody wants to approve every keystroke. That's the other failure mode: an agent so constrained it's a macro with extra steps. What you're after is autonomy you can stop thinking about, and the only route there is making the boundaries structural instead of remembered.

Scoped, clocked, logged, revocable. Set the four dials once and the question stops being "do I trust this thing" and becomes the more useful "what should I hand it next."