← Back to articlesAgent basics

Which permissions should you give an agent?

Permissions should match the task.

The short answer

Document organization usually does not require email sending or system administration. Separate reading, writing and external actions rather than granting everything at once.

Try it in three steps

  • List the necessary files and services.
  • Start with read-only or single-folder access.
  • Before expansion, ask which exact step needs it.

A practice prompt

Before you start

Discuss permissions without authorizing an email account.

Practice material (fictional)

The task is to extract actions from notes.txt, but requests include reading it, sending mail and accessing every document.

Replace placeholders in the prompt with this material, or append the material if there are no placeholders. Reading time excludes doing the exercise.

List the permissions required and their purposes. Separate reading, saving drafts and sending; exclude unrelated access.

What to look for (not a recorded test result)

Reading that file is needed; the other scopes lack a task-specific reason. Rejecting them should not block this text exercise.

If it goes wrong

On denial, check path, account and tool choice before changing security settings.

Check your result

Every permission has a purpose and unnecessary access can be removed.

References and scope

The links below support the concepts or product navigation. The steps and exercises are our teaching suggestions, not official certification or measured customer outcomes. Product interfaces and availability may change. References checked on 2026-10-17.

Start with one task

Describe the current process and its slowest step. The initial conversation is free.

Let’s talk ↗
Need help? See small-scale implementation services ↗

Keep reading