Before you let an assistant act on your accounts

The decision arrives as a blue button and one short line of explanation. Connect your Gmail. Connect your calendar. The assistant that has been summarising pasted text for a year offers to read the actual inbox instead, and the offer is genuinely useful, because most of the work of using an assistant well is getting the material in front of it. So you click. What you have just done is not what the sentence on the button said. You did not give it your last 20 emails. You gave it a standing capability over the mailbox, and in the case of ChatGPT’s Google connection that capability covers composing and sending, not only reading [1][5].

This guide is for a solo operator, a freelancer or a small team deciding whether to connect a consumer assistant to a real inbox, a real calendar, a real drive or a real payment method. It is not for an administrator writing policy for 200 people, and it is not for anyone building a connector for other people to install. The shift that helps is small and it is not about trust. Stop asking whether the assistant is good enough to be given your inbox. Ask what it is authorised to send, change or delete in there on a day when it gets something wrong, and whether you would be able to tell.

The connect button grants a capability, not a task

Read the permission list rather than the marketing sentence, because the two describe different things. OpenAI publishes the exact Google scopes that the Google app for ChatGPT requests, and the list says more than any onboarding screen. Gmail appears as https://www.googleapis.com/auth/gmail.modify [1]. Google’s own Gmail API documentation defines that scope as “Read, compose, and send emails from your Gmail account”, and records a single exclusion: it does not allow immediate, permanent deletion of threads and messages, bypassing the trash [5]. Compose and send are inside the grant. Nothing in the button said so.

Calendar appears as https://www.googleapis.com/auth/calendar.events [1]. Drive is the blunt one. Alongside three read-only Drive scopes, the list includes the full https://www.googleapis.com/auth/drive scope, which OpenAI says supports actions that create, update, share, move, upload, copy, or delete Drive-family files [1].

The shape of that list repays a second look. Contacts appears only as contacts.readonly and contacts.other.readonly [1]. Docs, Sheets and Slides each appear twice, once read-only and once not [1]. Somebody sat down and decided, service by service, where reading was enough. For your mailbox, it was not.

Google’s assistant makes the same move in plainer words. Gemini Apps can create, find and edit your events in Google Calendar and in the calendar apps shipped by Honor, Oppo, Samsung, Tecno and Xiaomi [6]. That is the honest description of what a connection is. You are not approving a request. You are approving a class of request, once, and every later instruction runs inside it without coming back to you for the same permission.

The practical consequence is that “can it read my email” is the wrong question, and the answer to it is almost always yes anyway. The question is which verbs came attached. Share and delete are in that Drive scope [1]. Nobody says the word delete out loud during onboarding.

What an assistant cannot do is as specific as what it can

The boundaries are real, they are documented, and they are strange enough that you cannot guess them. Gemini Apps create events on your default calendar unless you specify a different calendar [6]. They will not add or invite people to an event, and will not add or update the location or description of an existing event; Google’s advice for those is to open the calendar app and do it yourself [6]. Cancelling, though, they will do. The same page offers “Cancel my next meeting with [name]” as a prompt you can use [6].

Read that combination twice, because it does not track danger. The assistant is trusted to take a meeting off your calendar and not trusted to put a guest on it. Neither limit follows from a principle. It is a product surface, assembled by a team making judgement calls, and it will look different next quarter and different again on a competitor. Which is the argument for reading the help page for the specific assistant you are about to connect, on the day you connect it, rather than reasoning from what a similar tool did last year.

So the shape of the limits tells you nothing dependable about which actions are safe. You have to make that judgement yourself, action by action, and the axis that matters is not reading against writing. It is whether an action stays inside your own account and can be corrected, or reaches another person and cannot.

Standing authority is the second decision, and the larger one

There is a difference between an assistant that acts when you ask and an assistant that acts while you sleep, and the second one is a separate choice that often hides inside the first. Once Gmail is connected, OpenAI says eligible users can create an event-triggered, webhook-based task in Work that responds to new messages in a connected Gmail account [1]. In ChatGPT agent, each unique invocation counts against the monthly message limit, and that includes agent requests that are part of scheduled tasks [2]. Read the second sentence as a quiet admission that scheduled runs are ordinary runs you were not present for.

Anthropic’s guidance for Claude Cowork draws the line about as clearly as any vendor has. It tells you not to schedule tasks that access sensitive files, send messages on your behalf, make purchases, or take other actions that are difficult to undo [4]. Treat that as a general rule rather than a note about one product. Recurring authority is fine for work that produces a draft you will read. It is a different proposition for work that produces an effect someone else can see.

The cost people underestimate is not the failure. It is the review. Every action taken without you is an action you either check later or never check at all, and the second option is the one that actually happens once the volume is more than a handful a day.

Everything the assistant reads becomes a possible instruction

The reason to keep write access narrow is not that the model is careless. It is that the model reads things other people wrote. OpenAI describes prompt injection as a type of social engineering attack specific to conversational AI, in which a third party that is not the user and not the AI misleads the model by injecting malicious instructions into the conversation context [3]. It calls this a frontier, challenging research problem, and says it expects adversaries will spend significant time and resources to find ways to make AIs fall for these attacks [3]. That is a vendor telling you the input side is not closed.

Anthropic’s version names the two conditions that have to be true at the same time for the attack to succeed: Claude can read information outside your trusted boundary, and can perform actions that could compromise the user [4]. Hold those side by side and the design rule writes itself. A connected inbox satisfies the first condition permanently, because anyone can put text in your inbox. So the only lever you control is the second one.

This is also why a carefully worded instruction to the assistant is not a safeguard. Your instruction and an attacker’s arrive in the same context, as the same kind of text. The vendors do screen for it: Anthropic says it trains Claude to recognise and refuse malicious instructions, and scans untrusted content entering Claude’s context with classifiers, and then says plainly that the chances of an attack are still non-zero [4]. The permission grant is the control you hold. The wording is a preference.

Confirmations are the working control, and they degrade with use

The vendors’ answer to all of this is to keep a human in the path for consequential steps, and it works, up to the point where the human stops reading. ChatGPT agent includes user confirmations for high-impact actions and a watch mode requiring user supervision on certain sites [2]. It will also pause and prompt you to take control of the virtual browser, and while you control the browser, screenshots are not captured, which OpenAI says helps protect passwords and other sensitive data you enter [2].

Claude Cowork offers three settings. Under automatic approval, Claude reviews each action for safety before it runs and blocks anything it determines to be unsafe. Manual approval is the one Anthropic tells you to switch to when the task touches sensitive files, accounts or sites, when you are using a new tool, plugin or site for the first time, or when mistakes would be hard to undo, like sending messages or making purchases. Under skip all approvals, nothing checks its actions [4]. In every mode, Claude asks before permanently deleting files [4].

Gemini’s calendar actions come with an undo in the confirmation notification, and the same page carries the sentence that matters most in this whole guide: some things cannot be undone, like an email sent to event guests when an event is modified [6]. It names a second gap, quieter than the first. If you created an event with Gemini Live on in the background, Gemini cannot undo the event [6]. That is the real boundary. Not read against write, but reversible against irreversible. An event on the wrong calendar is a correction you make in a moment. A notification that has already landed in other people’s inboxes is a conversation.

OpenAI’s own user-facing advice is consistent with this. Limit an agent’s access to only the sensitive data or credentials it needs to complete the task. When an agent asks you to confirm an action, carefully check that the action looks right and that any information being shared is appropriate to share in that context. When it is operating on a sensitive site, such as your bank, watch it work. And ask it to do specific things rather than giving it wide latitude to potentially follow harmful instructions from elsewhere like emails [3]. The last of those is underrated. A narrow request is a smaller target.

The connected default now arrives without you choosing it

For a long time this was an opt-in problem for people who liked new tools. It is turning into a default. Alexa+ is now available to everyone in the US, free for Prime members and $19.99 per month without Prime [8]. Amazon describes customers using it to order takeout, find restaurants and make reservations, book a ride, or schedule services like home repairs [8]. Nobody in that household made a considered decision about delegating restaurant bookings to software. It came with a shipping subscription.

Treat that as the pattern rather than a fact about one product. Action authority is becoming a bundled feature of things you already pay for, on devices in shared rooms, used by people who never saw a scope list. If you run a small business from home, the assistant with your calendar may end up being the one on the kitchen counter, and the account behind it is the same account holding your work bookings.

The defence is not avoidance. It is deciding on purpose, at a moment you chose, which is a thing you can only do if you know where the toggle lives before you need it.

Connect it the way you would hand someone your keys

Start with a lane you can afford to have go wrong. A secondary calendar rather than the one clients see, a forwarding alias rather than the main mailbox, a Drive folder rather than the whole drive. Grant one thing, use it for a fortnight, and read what it produced.

Then find the revoke path and use it once while nothing is wrong. In a Google Account, third-party access sits on the linked apps page, where you select Access to your Google Account, choose the app, select See details, then Remove access and Confirm [7]. Google’s warning is worth knowing in advance: if you remove access, the app cannot access your Google Account, and this may make some features unavailable [7]. Better to learn which features break on a quiet Tuesday than during an incident.

Understand what revoking does not do. Disconnecting Gmail from ChatGPT removes the connection and stops related mailbox monitoring [1], but it does not reach backwards. Anything the assistant already read is in the conversations it read it into, and those chats follow the normal deletion path, scheduled for permanent deletion within 30 days unless they have already been de-identified and disassociated from you, or OpenAI must retain them longer for security or legal obligations [1]. A connection is a tap, not a window. Turning it off stops the flow and leaves the bucket.

And keep one sentence from Anthropic’s safety page in view while you decide any of this: you remain responsible for all actions taken by Claude on your behalf, including messages sent, purchases, data modified, and actions taken by scheduled tasks [4]. There is no arrangement here in which the vendor owns the outcome of a message you authorised software to send.

What still goes wrong

Permission lists go stale. Everything cited here was live on 5 September 2026, and the scopes, modes and limits will move, usually by widening. A grant you approved months ago under one description may cover more today, and none of the pages cited here carries a changelog you could compare against what you agreed to. The re-read on the checklist is not busywork; it is the only mechanism you have.

The deeper problem is that the granularity you want does not exist. You want an assistant that can draft in your mailbox but not send, or edit one folder but not share it. What you get is a mailbox scope that covers reading, composing and sending together [5], and a Drive scope that bundles create, update, share, move, upload, copy and delete into a single approval [1], because the underlying APIs were designed for applications, not for delegates with judgement problems. Until that changes, the boundary you are choosing is coarse, and the only fine control left to you is which account sits behind it.

Then there is you. Every safeguard described here assumes a person who reads confirmation dialogs carefully at 4pm on a Friday, notices that a summary mentions an email nobody remembers approving, and checks. One person running a business is the approval queue, the audit log and the incident response, usually while doing something else. That is survivable when the connected account is a side calendar and the worst case is an embarrassing invite. It stops being survivable at the moment you connect the main mailbox because the side one was too limited and you were in a hurry.