An AI agent permission is the access you grant so a product like Claude Duet, Meta Muse, or ChatGPT Dots can read an app — and, if you allow it, send, pay, or change something. The agent is only as contained as that list.
Vendors now ask before send, pay, sign, or delete. That gate fails if you approve on autopilot, or if you connected payroll and a shared inbox on day one. Scope the connection first. This page is that scoping list. It is not a way to bypass an agent’s safety checks.
Quick Answer: How Should You Scope an AI Agent?
Connect the smallest set of apps that can finish one job. Start read-only. Turn on send, pay, or delete only after you have rejected a bad draft. Disconnect anything you do not need this week.
| Do first | Wait |
|---|---|
| Calendar and one inbox you can afford to misread | Payroll, banking, trading, shared family or client drives |
| A test label or a sandbox Slack channel | “Connect all” on a 6,000-plugin marketplace |
| Read the approval text before you confirm | Saved-password sign-in until you trust the product |
Table of Contents
- Quick Answer: How Should You Scope an AI Agent?
- Why Agents Need a Smaller Scope Than Chat
- Read, Draft, and Act
- A Practical Connection Order
- What to Leave Disconnected
- How to Read an Approval
- After You Connect
- Frequently Asked Questions
- Conclusion
- Sources
Why Agents Need a Smaller Scope Than Chat
A chatbot sees the text you paste. An agent can open the apps you connected and keep working after you close the laptop. Claude Duet checks connected accounts on a timer, sends a morning brief, and runs tasks on its own virtual machine. Meta Muse and ChatGPT Dots follow the same pattern: background work plus tools.
Three consequences follow:
- A wrong “this is urgent” judgment can surface a private thread you did not mean to brief.
- A wrong approval can send that thread onward.
- Memory of older conversations can remain after you disconnect an app. Anthropic says disconnecting stops new access; it does not wipe what the agent already learned. Plan for that before you connect a client inbox.
Prompt injection — hidden instructions in an email or a web page — is why a broad connector is riskier than a narrow one. Fewer apps means fewer places an untrusted message can steer the agent.
Read, Draft, and Act
Split every connector into three levels. Stay on the left until the agent has been boringly correct.
| Level | Examples | Default |
|---|---|---|
| Read | Calendar, Drive search, Slack search, invoice list | Yes, for one job |
| Draft | Email in a notes doc, a slide outline, a job post you will edit | Yes, inside a tool you review |
| Act | Send, pay, sign, delete, post, run payroll | Off until you have a reason |
Claude’s own Microsoft 365 connector, on the main Claude app, already works this way: search is available, and write tools (send mail, edit calendar, post in Teams) depend on an admin. Claude only hits Microsoft 365 when you ask, not as a background crawl. Details are in AI agents and Microsoft 365. Duet’s preview does not include that connector yet, and it does check other connected apps in the background. Background plus write access is the combination to delay.
A Practical Connection Order
Use this order for Duet, and the same idea for Muse or Dots.
- Name the job. “Morning brief from my work calendar and one inbox,” not “run my business.”
- Connect calendar first. A wrong calendar brief is annoying. A wrong sent email is not.
- Add one inbox that is not your only copy of legal, medical, or payroll mail. Prefer a label or a dedicated address if the product allows it.
- Add one chat tool with a limit. Anthropic already says Slack works with limits inside Duet. Do not start with every private channel.
- Leave write actions off until the briefs match what you would have flagged yourself for several days.
- Turn on one write path — for example, draft a follow-up that you send yourself. Compare it with a note you wrote in Write with AI so you can see what the agent added.
- Payments last, and only through the vendor’s confirm step. Duet’s documented path is Link or Shop Pay: it confirms the item, you approve the spend, and the charge uses a virtual card. 1Password sign-in is still marked coming soon. Do not treat “coming soon” as on.
If the product offers a sandbox, a test Slack channel, or a second calendar, use that for the first week.
What to Leave Disconnected
Keep these off an agent until a human process already wraps them:
- Payroll and HR files (Gusto-style tools can draft payroll in Duet’s examples — that is a reason to wait, not a reason to connect on day one)
- Bank transfers and securities. Duet blocks trading and moving money between accounts even if you approve. Do not hunt for a workaround.
- Someone else’s account. Anthropic lists that as off-limits even with approval.
- Shared drives that mix clients, family, or medical records
- Password managers, until the vendor’s own permission step exists and you have used the agent without it
- Every marketplace plugin because the catalog says 6,000. Connect the one that matches the job.
Also skip tools you cannot audit. If you cannot open a log of what was read, do not grant write.
How to Read an Approval
An approval dialog is the product. Before you confirm, check four lines:
- Action. Send, pay, sign, delete, or post — not “continue.”
- Destination. Which address, which channel, which amount.
- Body. Skim the actual text. Agents misread threads; Anthropic says Duet still might.
- Scope. One invoice reminder is not “email the whole list.”
If any line is vague, deny it and ask for a draft in chat instead. Denial is a successful run.
For meeting follow-ups, a safer pattern is still: capture notes in Knowant Notes, then send the email yourself using this follow-up guide. The agent can suggest. You can own the send.
After You Connect
- Review connectors weekly. Disconnect what you did not use.
- Assume disconnect stops future access and does not erase memory. Avoid connecting data you cannot bear to have summarized later.
- Watch usage. Duet’s background checks spend the same Pro or Max limits as chat. A connector you forgot is also a meter you forgot.
- If you are on a company tenant, do not connect a personal agent to work Microsoft 365 until an admin has allowed it. Personal Outlook.com accounts are not what Claude’s work connector supports.
- Tell the agent what “urgent” means in plain language: your own calendar conflicts, not every newsletter.
Frequently Asked Questions
What permissions should I give an AI agent?
Start with read access to one calendar and, if you need it, one inbox. Add draft and send only after the briefs are accurate. Leave payments, payroll, and delete rights off.
Is it safe to connect Gmail to Claude Duet?
It can be reasonable if that inbox is not your only store of sensitive mail, you read approvals, and you disconnect it when the job is done. Anthropic says Duet can still misread a thread. Treat the connection as a trial, not a default.
Should I connect a password manager?
Not in the first setup. Anthropic lists 1Password sign-in for Duet as coming soon, and only with permission. Wait until that control exists, then allow a single site rather than the whole vault.
Does disconnecting an app delete what the agent already saw?
Anthropic’s Duet help article says disconnecting stops further access, while memory from earlier conversations can remain. Do not connect something you would need fully forgotten.
What if my company uses Microsoft 365?
Claude’s main app can use a Microsoft 365 connector on work accounts after admin consent. Claude Duet’s research preview does not include Microsoft 365 yet. Read AI agents and Microsoft 365 before you connect Outlook or Teams anywhere else.
Can the agent move money if I approve it?
Claude Duet’s documented rules block securities trading and moving money between accounts even with approval. Other products differ. Read that product’s blocked-action list before you connect a bank.
Conclusion
Scope is the control you still have when the agent is proactive. Connect one job, keep write access off, read the approval, and disconnect what you are not using. Marketplace size is not a checklist.
The product-specific limits for Anthropic’s agent are in Claude Duet explained. The model under it is in Claude Opus 5.5 explained. The Microsoft 365 gap is in AI agents and Microsoft 365.
Sources
- Anthropic — Get started with Claude Duet
- Anthropic — Introducing Claude Duet
- Anthropic — Connect to Microsoft 365