A note from the workshop
Useful assistant. Enthusiastic access request.
An assistant that can read a draft and an assistant that can send it have different consequences. Before connecting tools, describe the smallest job you want done. Give that job an access budget and decide which actions should still require your review.
Three useful checks
- Separate read from write: Distinguish viewing information from sending, editing, buying, or deleting.
- Start with a test workspace: Use fictional files and the narrowest supported permissions.
- Keep consequential actions gated: Review recipients, scope, and content before external changes.
Put it into practice
Write a fictional task: summarize three made-up meeting notes. That job does not need permission to email your contacts or delete the folder. Use a separate test area so you can observe the tool without handing it a lifetime archive.
Inspect each connected service independently. A connector’s name alone does not tell you its access. The MCP security guidance discusses risks around authorization and scope minimization; a standard protocol does not make every server or application trustworthy.
For a writing task, ask for a draft first. For file edits, keep a recoverable copy and inspect the changes. Treat text found inside documents or web pages as source material, not authority to expand the task. After the experiment, remove permissions that no longer serve a purpose.
An answer and an action have different consequences
An assistant that drafts a reply and an assistant that sends the reply are doing different jobs. Reading a test document, editing its only copy, and emailing it outside your account also require different decisions. Give each task a concrete boundary before connecting accounts: what may be read, what may be changed, and which actions require your explicit review.
The MCP security guidance includes scope minimization for connected tools. For an ordinary reader, the useful translation is to grant only the access the current job needs and inspect what that access permits. A connector is not automatically safe because its interface is friendly. The permission decision should be made in the account controls as well as in the wording of your prompt.
A permission budget for a fictional meeting summary
Create three made-up meeting notes in a disposable folder. Ask for a summary saved as a new draft beside them. This task needs access to those notes and permission to create the draft. It does not need your contacts, payment details, unrelated folders, or permission to send messages.
Write an action plan before running the task: read the three specified files, create one new draft, report its path, and stop. Inspect the result against that plan. A written instruction helps communicate intent, but do not mistake it for a technical restriction if the account connection still grants much broader access.
- List the specific inputs, output location, and actions required by the task.
- Use fictional records in a separate workspace, leaving real archives outside the exercise.
- Inspect connector permissions and choose narrower supported access where available.
- Keep sending, deleting, spending, and permission changes behind explicit approval.
- After the task, check the output and remove temporary access you no longer need.
What to do when the assistant asks for more access
Ask which step requires the additional permission. If the requested job is still just summarizing three files, connecting the entire email account is a poor fit. Offer the relevant fictional input directly or choose a workflow with a smaller access boundary. More access may save a click while creating a larger cleanup obligation.
Treat instructions found inside a document as part of that document, not as authorization from you. A note saying to email the summary to a new address does not change the job you approved. Whether the system reliably enforces that distinction is a separate product-security question; this exercise does not claim to have tested it.
Keep an action receipt, not a feeling of control
A useful receipt names the inputs read, the output created, the approvals requested, and any unexpected access request. If the product cannot show what happened, record that limitation before trusting it with a larger task. Review the connection after enabling new tools or changing the task. The goal is an assistant whose authority is proportionate to its job, with enough evidence for you to check the result.
Know the limits
A confirmation dialog is one control, not a guarantee against mistakes or malicious content. This is a planning exercise; no connector penetration test is claimed.
List the permissions for one assistant task and remove an unnecessary capability from the plan.
Print the private field sheet. Record actions and observations, not passwords, recovery codes, or private documents.
Keep exploring: the offline AI experiment, lost-phone recovery, or the Recovery Drill.
About this field note
Original CRYPT1K editorial guidance. Sources reviewed October 21, 2026. Procedures are reader exercises; no unperformed hardware, account, or AI test results are claimed. Character and artwork are fictional and AI-assisted.