Research and analysis. Editorial standards.
Start with the smallest useful task
“Help with my email” is a broad goal. “Draft a summary of messages in this project folder, without sending anything” is a task you can bound. Write the output and prohibited actions before you approve access.
Make an inventory with three columns: resource, allowed action, and approval requirement. For a mailbox, reading selected messages may be sufficient. Sending, deleting and changing forwarding settings should be evaluated separately. A permission screen may bundle several powers together; if it cannot offer the scope you need, consider another workflow.
Check the destination as well as the source
An agent can read the correct file and still expose it to the wrong audience. Identify where results go: a private draft, a shared workspace or an outside service. Use sample records first. Avoid giving an agent raw passwords or tokens in a prompt; use supported authorization mechanisms and inspect the access granted.
Approval needs to be meaningful. For an outgoing message, the person approving should see the recipient, attachments and final text. “Continue?” is insufficient if the consequences are hidden.
Test the stop and revoke path
Before a recurring workflow begins, confirm that you can stop the task, revoke its connector access, and locate its action history. Keep a record of the permissions you approved and the task owner. Review that inventory when integrations change or the owner leaves.
Use ten sanitized records. Allow reading only. Require source references. Save a private draft. Confirm that revoking access prevents a new run.
The purpose is to learn whether the workflow produces value before broadening its authority. Permission restraint does not eliminate model errors, but it reduces what an error can affect.
Related articles
Google Gemini Agent Is Here: What It Does, How It Works and the Security Risks to Know
Google’s new workplace agent puts connected business systems in reach of a prompt. Here is what is confirmed, what remains unclear, and how to evaluate the risks.
Prompt injection: when a document tries to give your agent orders
Understand the boundary between data and instructions, and why permission controls matter.
What to remove before you paste work into an AI assistant
A quick review for credentials, personal data and confidential context.