An AI agent can use connected tools to take actions, such as changing a document or creating a calendar event. That makes the permissions you grant as important as the instructions you type.
For a first experiment, choose a task that produces a draft you can inspect. You can learn whether the result is useful before allowing the assistant to send messages, spend money, or change important records.
Choose one result you can check
A good starting task is turning a short set of notes into a checklist. Define what a successful result contains: each task, the person who has agreed to handle it, any confirmed deadline, and unresolved questions.
Give the assistant a fictional example first. If all you need is a draft list, a normal chat may be sufficient. You do not need to connect email, banking, shopping, and calendar accounts to try it.
Write the task boundaries
Use a small instruction card rather than an elaborate promise that the AI will always act in your best interests:
Task: Turn the notes I provide into a draft checklist. Use only those notes. Keep missing information marked as unknown. Do not send messages, make purchases, create events, or change existing files. Show the draft and any questions. State what you actually completed.
Adjust the card when your task changes. A preference such as “always be careful” is difficult to evaluate; “show the recipient and message before sending” describes a result you can inspect.
Match access to the task
Review the actual connection settings before granting access. Reading information, editing it, deleting it, and sending it elsewhere are different capabilities. Use limited or read-only access where the service supports it.
Written instructions are not a substitute for technical restrictions. External content can contain instructions intended to misdirect an agent—a problem called prompt injection. Anthropic’s research explains how malicious instructions in web content can redirect an agent’s actions. This is a reason to limit access even when your own prompt is clear.
Check how to stop a task and disconnect the account. If the service cannot limit access enough for your experiment, use manually supplied information instead.
Keep spending as a separate decision
For an initial trial, ask the agent to prepare a shopping comparison or a bill-reminder list without giving it payment access. If you later consider automated purchases, inspect what approval controls and enforced limits the service actually offers.
A typed spending limit is not necessarily a card or account restriction. Before approving an order, check the merchant, item, total including delivery, and whether a recurring charge is involved. Do not assume cancelling an AI task also cancels an order already placed.
Test missing and conflicting information
Include one missing deadline and two contradictory notes in your trial. Does the assistant flag them, or silently choose an answer? Check whether it invents a person’s agreement, duplicates a task, or treats a tentative date as confirmed.
For example, “Sam might collect the parcel Tuesday” should not become “Sam will collect the parcel Tuesday.” Revise the instructions if the difference is lost.
Keep a short record of the input, result, correction, and time spent checking. Judge the task by the work it saves after review.
Confirm what actually happened
A proposed calendar event is not proof that an event was saved. A message draft is not a sent message. When you eventually allow an action, verify it in the destination app and check the relevant recipient, date, or document.
Expand one permission at a time when there is a clear benefit and a way to check the result. Our AI exit-plan guide can help you document the task so it remains usable if the service changes.
Reviewed October 1, 2026. Prepared with AI assistance and checked against the sources linked above. See our disclaimer.
Featured photo: Thomas Bormans on Unsplash. Illustrative photo.
