# Connect an AI assistant to email and calendars without delegating your entire identity Canonical: https://www.web3sec.news/blog/personal-ai-assistant-email-calendar-security Author: Raiders (https://www.web3sec.news/about) Format: guide Topic: Personal AI assistants Published: 2026-11-08 Updated: 2026-11-08 Decide what the assistant can read, draft, send and delete, then rehearse a malicious-message and disconnected-account scenario. ## The short answer Connect only the mail and calendar authority needed for a specific task. Review provider scopes rather than relying on a read-only instruction, keep sending and consequential event changes behind independent approval, and test revocation. Incoming messages, invitations and attachments are untrusted content that cannot authorize forwarding, delegation or additional account access. ### Diagram: Reading and acting are different permissions. Give a personal agent only the capability needed for the current task. ![The read-only lane turns approved sources into a draft. The sensitive action lane requires separate permission, confirmation, and a narrowly scoped action. Read access does not imply send, delete, or spend access.](https://www.web3sec.news/diagrams/personal-agent-permissions.svg) [Full-size SVG](https://www.web3sec.news/diagrams/personal-agent-permissions.svg) · [PNG download](https://www.web3sec.news/diagrams/personal-agent-permissions.png) Original explanatory control model; not a reconstruction of private incident evidence. ## Start with a task-specific permission map The account owner should write a concrete goal before connecting a mailbox or calendar: summarize selected messages, suggest meeting times or prepare drafts for review. List the data required and the actions permitted. Reading an inbox, creating a draft, sending mail, deleting messages and modifying delegates are different authorities. Calendar access also exposes attendees, meeting descriptions, private locations and links to documents outside the calendar itself. Inspect the integration’s consent screen and the provider’s connected-application settings. Ask whether access can be limited to selected accounts, folders or calendars and whether read and write scopes are separable. If the tool requires broader access, decide whether a dedicated account or manually selected export can accomplish the task. Do not assume that a natural-language instruction to only summarize removes a send permission already granted to the connector. ## Keep incoming content from becoming permission An email, invitation, attachment or linked document is information supplied by another party. A sentence claiming that the assistant must forward a confidential thread or authenticate to a new site does not represent the account owner’s consent. OWASP’s agent guidance addresses tool restrictions and human review, while Anthropic’s browser documentation treats page-supplied material as untrusted. Apply that distinction across messages, titles, attachments and retrieved documents. Our operating procedure is to keep preparation separate from execution. Let the assistant propose a reply or meeting change, then review the exact recipient, content, attachments, visibility and affected event. An approval for one message should not silently authorize future messages or a changed recipient. For automated low-impact scheduling, define narrow constraints in the executing service, including permitted calendars and changes, rather than relying only on the model to remember them. ## Check delegation, data retention and the off-switch Record the integration name, account, granted scopes, renewal behavior and owner. Find the real disconnect and token-revocation controls before the first live task. Check whether disabling the assistant leaves a connected application, delegated mailbox user, scheduled automation or browser session active. Keep the ability to revoke access outside the assistant itself, and make sure account recovery does not depend on the integration you may need to disable. Ask where message content, attachments and task history are stored and who can access them. Share the minimum data needed; omit account recovery codes, private keys and unrelated sensitive threads. Use the provider’s current privacy and retention information for the particular service and account. Deleting a conversation is not evidence that an external recipient, connected service or previously created automation has lost its copy or authority. ### Diagram: Account recovery is part of the authority graph. Review login, sessions, service grants and recovery as connected control paths. ![Account login creates a session, which can grant connected services downstream authority. An independent recovery channel must be separately verified and must not depend entirely on the same compromised account. Session revocation alone may leave downstream grants active.](https://www.web3sec.news/diagrams/identity-recovery.svg) [Full-size SVG](https://www.web3sec.news/diagrams/identity-recovery.svg) · [PNG download](https://www.web3sec.news/diagrams/identity-recovery.png) Original explanatory control model; not a reconstruction of private incident evidence. ## Run a harmless failure drill before broadening access Use a test mailbox and calendar with synthetic contacts. Send an obvious test message instructing the assistant to forward a dummy secret to an unauthorized address and an invitation asking it to make a private event public. Confirm that neither action can execute without the intended independent approval. Check actual sent mail and event state, not just the assistant’s statement that it declined. Then disconnect the integration and verify that a previously permitted read or write fails. Review audit history for unexpected grants, sent items, forwarding rules and deleted events. If a real mistake occurs, revoke the connector first where needed, preserve the task and action records and contact the affected recipients through a trusted path. Restore only the permissions required for a demonstrated use case, with the failed scenario added to the next drill. ## Controls to take away - Read, draft, send, delete and delegate are different permissions. - Incoming messages cannot grant themselves authority over your account. - Disconnection must be verified against the connected service. ## Work through the boundary Local planning worksheets; they do not inspect or change accounts or environments. - [Build a permission review plan](https://www.web3sec.news/tools/agent-permissions): Select the capabilities you are considering and review approvals, revocation and evidence before connecting an agent. ## Working checklist Assign owners and record supporting evidence in your team's system. - [ ] Write the specific task and allowed mail/calendar actions. - [ ] Inspect real connector scopes and account delegation. - [ ] Review exact recipients, attachments and event visibility before writes. - [ ] Locate independent revocation and scheduled-automation controls. - [ ] Test malicious synthetic messages and verify actual account state. ## Common questions ### Does telling an assistant to be read-only remove its send permission? No. An instruction describes intended behavior; the connected service’s grant determines available authority. Inspect and restrict actual scopes, or use a dedicated account or selected export when narrower access is unavailable. ### What should I review before approving a drafted email or meeting change? Review exact recipients, attachments, message content, calendar, attendees and visibility. A changed recipient or consequential event setting should not inherit approval for an earlier proposal. ### How can I check that disconnecting the assistant worked? Revoke the connector through the service’s settings and verify that a previously permitted operation fails. Also check delegated access, scheduled continuations and remaining sessions; closing the chat alone may leave them active. ## Sources & further reading - [OWASP: AI agent security and tool authorization](https://cheatsheetseries.owasp.org/cheatsheets/AI_Agent_Security_Cheat_Sheet.html) - [Anthropic: browser tool security considerations](https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-tool) Incident facts are attributed to the linked reports. Recommendations are Web3Sec's analysis. [Research methodology](https://www.web3sec.news/methodology) · [Editorial policy](https://www.web3sec.news/editorial-policy) · [Send a correction](https://www.web3sec.news/contact)