Personal AI assistantsguide
Connect an AI assistant to email and calendars without delegating your entire identity
Decide what the assistant can read, draft, send and delete, then rehearse a malicious-message and disconnected-account scenario.
Agent field manual / Start with the authority
Useful assistance.
Deliberate limits.
An assistant that summarizes a document needs different access from one that sends email, changes a bank beneficiary, installs a package or runs a shell. Decide which job you are delegating—and where the authority to act actually lives.
Personal accounts
Read, draft, send.
Review mail, calendars, connected applications and recovery. A message or invitation cannot grant the assistant more authority.
Review a personal assistant ↗Financial information
Explain, then verify.
Separate analysis from account access, transaction signing and execution. Keep final authorization and recovery outside the model.
Review financial permissions ↗Security research
Scope the lab first.
Check program authorization and isolate unfamiliar repositories, install hooks, dependencies and generated commands from everyday credentials.
Prepare a bounded workflow ↗
Keep source material separate from the authority to act.
Original Web3Sec diagram. On small screens, scroll the figure or open the full-size version.Keep the mechanism in view
Review the task, then the boundary.
Each guide includes a failure drill, recovery considerations, primary references and a working checklist.
Financial agent operationsguide
Financial AI agents: separate research, transaction preparation and execution authority
Design payment and treasury workflows around verified destinations, transaction-bound approvals, limits and an independent stop control.
Research sandboxesguide
Run unfamiliar research repositories without lending them your laptop’s credentials
Inspect before executing, isolate dependencies and tests, constrain network and filesystem access, and verify disposal with dummy secrets.
Authorized security researchguide
AI-assisted bug bounty work: keep scope, execution and evidence under researcher control
Use agents for understanding and reproducible reporting while preserving program authorization, data boundaries and meaningful human validation.
MCP installation reviewguide
Before installing an MCP server: review the package, process and connected account separately
A preflight and change-review procedure for local and remote MCP integrations, from installation hooks to token revocation.
Agent credentials & recoveryguide
Agent credentials: issue the smallest useful secret and prove you can revoke it
An operating procedure for task-scoped identities, secret delivery, output review and recovery after unintended access or upload.
Browser agent sessionsguide
Browser agents and logged-in sessions: protect the account behind the tab
Review the authority inherited from cookies, browser profiles, connected sites and downloads before an agent uses an authenticated browser.
Memory & retrievalguide
Agent memory and RAG: prevent retrieved text from becoming persistent policy
Track source provenance, enforce current retrieval permissions and test whether poisoned content survives into later tasks.
Skills & pluginsguide
Review agent skills and plugins as instructions, dependencies and delegated authority
Inspect the whole instruction bundle, referenced resources and effective permissions before enabling a workflow extension or accepting its update.
Unattended automationguide
Unattended agents: bound schedules, retries, cumulative usage and stale approvals
Make repeated agent work stop predictably when permissions, timing, costs or external side effects no longer match the approved task.
Agent network isolationguide
Agents, localhost and internal networks: enforce what the executor can actually reach
Protect local bridges, development services, cloud metadata and internal APIs with explicit network and application boundaries.
A plan needs an enforcing system.
The worksheets produce review prompts from the capabilities you select. They do not inspect the actual provider, sandbox, permissions or repository. Check the real grants, mounts, subprocesses and revocation behavior before relying on the plan.
Open the planning tools ↗