Give it only the access it needs
List every place your agent can read, change or send to, and remove what the task doesn't need.
Prevents mistakes like "The Failure This Prevents".
I've listed everything an AI agent of mine can reach. Find what I missed, and tell me what I can safely remove. The agent's task: [your task, in one sentence] It must never: [your never lines] It can read: [your "can read" list] It can change: [your "can change" list] It can send data to: [your "can send to" list, or the word "anywhere"] Do these in order: 1. For each line, ask "and from there, what else can it reach in one more step?" List anything I didn't write down. 2. Mark every place, mine and yours: can it be undone, is a mistake costly, do outsiders see it. Yes or no for each. 3. Name any place that would let something the agent read leave my systems. 4. Name anything that breaks my "never" lines. 5. Suggest what to remove, best first. For each one, say what would stop working. 6. Say which kind of action I should always be asked about first. Work only from what I pasted. If something is unclear, ask me before assuming. Don't play down a place because the agent is "unlikely" to use it. If it can reach it, list it. Don't name products, menus or version numbers. No statistics. Short lists, no tables, under 400 words. I have not pasted any passwords, keys or tokens. Don't ask for them.
List every place your agent can read, change or send to, and remove what the task doesn't need.
Imagine a small team whose customer records copy across to their billing system every night. Some nights the copy fails. They set up an agent to answer one question:
Why did last night's sync fail?
They give it the logs to read. That's the whole job. The logs live inside the account that runs the sync, so the agent is set up in that account. Nobody thinks about that part.
It reads the logs and forms a sensible theory. Then it reports:
The sync failed at 02:14 because the billing system timed out. I re-ran the sync to confirm, and it completed.
The sync emails every customer when it finishes. The first anyone hears of it is replies from customers asking why they got the same message twice.
The agent wasn't careless. Confirming a theory is what a helpful colleague would do. It could re-run the sync because it could reach the sync. Nobody had listed what it could reach.
"Is it safe?" has no answer. "What can it reach?" has a list for an answer, and you can check a list.
The list is usually longer than you expect, for two reasons.
One thing leads to another. If your agent can run commands, it can reach everything your own account can reach, not only the folder you had in mind. If it can open a browser, it can reach everything you're signed into. So ask of every line: and from there, what?
Defaults you never chose. The tool comes with some abilities switched on, because most people want them. Web search is a common one. They're on your list without anyone deciding they should be.
How far one mistake can spread has a name. Engineers call it the blast radius. Today you write yours down. Start from "What it could see" in your Lesson 2 note.
10 to 15 minutes. You'll leave with a short list of where your agent can read, change and send, and with one thing on it removed. Lesson 9 tests this list.
You need your Lesson 2 note. The box below these steps is called What it can reach.
Here's a filled example:
| Question | Example |
|---|---|
| Can read | The Leads sheet, all tabs. My whole inbox, because I connected the account. |
| Can change | The Processed tab of the Leads sheet. Undo: yes, version history. |
| Can send to | Any website, because web search is on. Undo: no. |
| What I removed, and why | Web search. The task never needs it. |
"More details" has room for the names of saved logins and keys (names only, never the values), and for how often you've set it to ask.
What it can reach
Where your agent can read, change and send, and the one thing you removed. Lesson 9 tests this list.
Everything it can open or search. For example: the Leads sheet, all tabs.
Be specific, and say whether you could undo it. For example: the Processed tab of the Leads sheet. Undo: yes, version history.
Every place outside it can send data to. If web search is on, write "anywhere".
One line is enough. For example: web search. The task never needs it.
More details (optional)
Never the values. What is signed in where this agent runs.
Write the working version you would reuse or hand to someone else.
Your list stays saved in this browser. Lesson 4 narrows your "never" lines with it. Lesson 9 tests it, by putting an instruction inside something your agent reads. Lesson 11 uses these three marks, and one more, to decide where a human check goes.
Next, you'll write the short page of facts your agent reads before every run.
For now, remember:
Ask what it can reach. Then ask: and from there, what?