Connecting Email, Calendar, Docs and a CRM Safely

Start every connection as read only. Let the agent look before you let it change anything. Many first projects need nothing more than reading.

When you do allow changes, allow the smallest change that does the job. 'Create a draft' is safer than 'send'. 'Add a comment' is safer than 'edit'. 'Create a task' is safer than 'delete'.

A Safe Order

• Read only, on a copy or a test account if possible.
• Create drafts and suggestions that a person approves.
• Allow low-risk changes with an activity log you review.
• Allow sending or deleting only after weeks of clean results, and only where a mistake is cheap.

A Permissions Table (Maya, Made-Up)

• Email | read only | summaries and categories | never send
• Calendar | read only | find free times | never accept or decline
• Shared folder | read only on the exports folder | month-end files | no access to other folders
• CRM | no access in stage one | not needed yet | revisit in week three

Common Mistakes

• Giving the agent your whole mailbox when it needs one folder. Fix: scope access to the folder or label.
• Using your main account for tests. Fix: use a copy or test account first.
• Granting write access in week one. Fix: write access comes only after weeks of clean drafts.

Exercise

• For each system in your use case, write the minimum access it needs.
• Write the most damaging thing an agent could do with that access, and what you'd do about it.
• Pass condition: a permissions table with one row per system, a 'never' column filled in, and no row that grants more than the task needs.