The Agent Trust Check
Ten questions to answer before you connect an agent to your email, calendar, or card. Run them once per agent. If you cannot answer one, that is your answer for now.
- 01What can it do without asking me first?Find the approval gates before you find them by surprise.
- 02What am I connecting on day one?Grant read before write. Calendar before inbox. Nothing that spends money in week one.
- 03Can it spend, and what is the cap?If there is no cap you can set, the cap is your card limit.
- 04What does it keep about me, and where does that live?Ask where, not only whether. A copy you cannot point at is a copy you cannot delete.
- 05How do I see what it did while I was away?Look for a log you can read, not a summary it writes about itself.
- 06How do I revoke access, and does revoking also delete?Cutting off access and erasing what it already took are two different buttons. Find both.
- 07What happens when it gets something wrong?Find the undo, the correction path, and who pays for the mistake.
- 08Who else sees what it sees?Ads, model training, support staff. Read that page before you connect the inbox. If you cannot answer this in one sentence, the data is not yours.
- 09What is the cheap honesty test?Give it one small task you can verify yourself before you give it one you cannot.
- 10What is my exit?You should be able to take your data and leave without a phone call.
The rule under all ten: an agent earns access the way a person does, a little at a time, by being checkable.