You Gave the Intern the Keys. Did You Watch What They Did With Them?

I keep meeting founders who hired an AI agent the way they’d hire a nephew for the summer. Handed over the keys, said “figure it out,” and walked away feeling very modern.

Then panicked three days later when they realized what “figure it out” authorized.

An agent is not a chatbot with better manners. A chatbot answers what you ask. An agent goes and does something, on a loop, with your tools and your authority, until the goal is finished or it reaches a limit. Some agents stop and ask. Others make their best guess and keep going. You want to know which kind you’re dealing with before the guess matters. That is the first real answer to how much access to give an AI agent: less than it asks for, until you’ve watched it work.

It starts with a goal. Something like “organize the Q3 kickoff.” Then it needs permissions, the actual keys you hand it. Read-only access to your inbox is a very different decision than “manage my inbox.” One lets it look. The other lets it act. This is the actual decision point, not the setup screen you click through to get to the good part.

How Much Access to Give an AI Agent Is Never the Agent’s Decision

Many founders skip the part where a task may need more than a single permission. The integration may ask for five. Many people click “Allow” because sorting them out feels like extra work. That’s a keyring problem rather than a keys problem. You handed over five doors to open one.

Once it has access, it runs a loop. It checks your calendar, proposes a date, emails the attendees, reads their replies, changes the date, sends the update. Each action creates new information and another decision, made without checking back with you first.

Founders keep asking whether the agent can do the task. Capability isn’t the gap anymore. What happens when it’s wrong, and whether you can undo it, is.

How Much Access to Give an AI Agent Depends on What You Can Undo

A drafted reply waiting for your approval is easy to fix. Delete it, rewrite it, move on. That same agent updating the calendar and emailing your entire client list is a different category of decision. Same underlying technology. Completely different consequences.

If you’re reading this because it already happened, you’re not the audience for a prevention checklist right now. You’re looking for the record of what the agent actually did, in order. That record exists somewhere. Find it before you decide what to fix.

So how much access to give an AI agent was never really a question about the agent. It’s about what the actual cost is if this goes sideways, and whether you can take it back if it does. That’s knowing which mistakes are free and which ones aren’t.

Start with something low-stakes and fully reversible. Watch what it does with the access you gave it, not just whether it finished the task. Give it bigger keys only after you’ve watched it use the smaller ones.