AI Agent Permissions: A Parent's Checklist Before Connecting Apps

Before connecting an AI agent to an app, write down what it can read, what it can change and how you will stop its access. If you only need an activity suggestion, a short, anonymous task description may do the job without connecting your inbox, calendar or child's school account.

The important decision is not simply whether you trust the brand. It is whether the particular access request is necessary for this particular task.

This guide gives you a permission worksheet, a fictional family example and a cleanup checklist. It is for adults managing their own eligible accounts. It does not make adult-only products appropriate for children to operate.

Official product documentation checked October 8, 2026. The examples and checklists are editorial resources, not a security audit or a test of the products' controls.

Start with the smallest useful task

Compare these two requests:

Organize our family learning. Read my email and calendar, learn about the children and handle whatever needs doing.

Draft three 15-minute indoor activities for an adult and a child aged 8–10. Use paper, pencils and building blocks. No purchases or account connections are needed. Return a plan in this conversation.

The first request leaves the purpose, information and possible actions open. The second gives you something you can inspect before the agent touches another service.

There may eventually be a reason to connect an app. Start by proving that reason: what important part of the task cannot be completed with the information you deliberately provide?

For example, finding three public library events needs public event pages and a general area. It does not automatically need the child's full name, school timetable or your entire calendar.

Use this six-part permission checklist

Read the actual connection screen and product settings. A connector described as “help with calendar” could involve more access than the task needs. If the scope is unclear or too broad, leave it disconnected and use a manual alternative.

These are questions to answer, not switches every product necessarily provides. Writing “read only” in a prompt does not turn a broad connector into a technically restricted one.

If a service offers granular access, use the narrowest scope that completes the task. If it does not, decide whether to avoid the connection altogether.

A worked example: remove the family details the task does not need

Imagine an adult wants ideas for a short reading activity. A realistic-looking but entirely fictional draft might contain:

My child [full name] attends [school] in [neighborhood]. Here is a teacher's private message, their recent assessment and our weekly schedule. They enjoy space stories. Please prepare an activity for Thursday after pickup.

Most of those details do not help design the activity. A more focused version is:

Prepare a 15-minute reading activity for an adult and a child aged 9–11 who enjoys space stories. Use an original short passage or material I have permission to use. Include one prediction question, one question requiring evidence from the passage and one creative extension. No accounts or scheduling are needed.

The second version preserves the learning requirements while removing names, school information, an assessment and a family timetable.

This is data minimization, not a promise of anonymity. Removing a name from a uniquely identifying story may still leave recognizable details. Ask whether the task needs the detail at all.

Check more than the visible paragraph

If you do upload permitted material, inspect the whole file or image. Names can appear in a worksheet header, a photo background, a filename or another page in the document. A teacher's permission to use a worksheet for homework does not automatically answer whether it may be uploaded to an external service.

When the source contains another family's details, use a new generic example instead of trying to edit around them.

Turn a vague approval into an inspectable decision

“May I continue?” is not enough information to approve a consequential action. Before agreeing, identify the target, the exact action and its effect.

Use this worksheet:

“The date looks right” is only one check. An event can have the correct date and still invite the wrong person or repeat every week.

For an initial family task, a useful default is to let the agent prepare a proposal and perform the final action yourself. If you later use an approval feature, understand whether you are approving one action or saving a rule for future actions.

Grok Bot's documentation distinguishes a one-time approval from an “Always allow” rule. It also describes automated review as one layer of protection, not a guarantee that every side effect is reviewed. Official security documentation

Keep instructions separate from access controls

Here is a reusable task brief:

Task: Prepare [specific output].

Use only: [the text or public sources I deliberately provide].
Return: [the format and number of items].

Do not send, publish, purchase, book, modify existing files,
connect accounts or create a recurring task.

If the task appears to require additional access, explain what
is missing and offer a manual alternative. Stop after the draft.

List any facts I must verify before using your result.

This communicates your intent. It does not prevent a tool from using access it already has, guarantee compliance or replace the product's permission settings. Check those settings separately.

When reviewing a result, also notice unexpected instructions encountered on external pages. A page that tells the agent to upload your files is not permission from you. If the proposed action has drifted away from your task, stop and inspect it rather than approving just to finish.

Check what is shared across assistants

A separate name or avatar does not necessarily mean separate storage.

For example, Grok Bot documentation says Bots within your account share a computer, including files, browser sessions and app logins. Do not use two Bot names as a boundary between work material and family material. Official product overview

For any agent, ask:

• Is the connection available only to this assistant, or to other features in the account?
• Can another assistant reach the same files or signed-in browser?
• Is this a personal account or an employer-managed environment?

If you cannot answer, keep the family task outside the connected workspace. An employer's approved work tool is not automatically an approved home-learning environment.

Plan the exit before you connect

Stopping a task, disconnecting an app and deleting information are different jobs. The exact controls depend on the product.

Use this sequence as an inspection checklist, then follow the current product instructions:

1. Stop current and future work. Inspect active tasks, schedules and event-triggered routines. Closing an app may not stop cloud work.
2. Remove ongoing access. Disconnect the integration and inspect the source service's authorized apps and sessions. Revoke access there where appropriate.
3. Inspect retained information. Look for uploaded files, saved outputs, conversations, memory and shared workspace data.
4. Remove what the task no longer needs. Use the relevant deletion controls. If a control does not explain what it removes, consult the provider's documentation or support.
5. Check actions already completed. A sent message, external file or calendar change needs separate handling. Disconnecting does not undo it.

For Dots, OpenAI distinguishes app disconnection from removing information already acquired. Deleting a Dot also does not delete ChatGPT memory or files stored elsewhere. Avoid treating any one of these actions as “erase everything.” Dots privacy FAQ

Keep a small connection record

You do not need a complicated system. Save this privately, without passwords or tokens:

Product and account type:
Task and finish date:
Connected app and permitted scope:
Files deliberately supplied:
Scheduled or event-triggered work:
Where to stop tasks:
Where to revoke access:
Where to inspect retained information:
Cleanup completed and checked on:

The purpose is to make the next decision easier. If the activity works without a connection, record that too.

If you are still choosing the type of tool, start with our parent’s guide to AI agents.

Frequently asked questions

Is read access harmless if the agent cannot change anything?

No. Reading can expose information that was not necessary for the task. Consider who the information concerns, whether you may share it and whether a smaller input would work.

Does turning memory off delete old information?

Do not assume so. Check the specific product's retention and deletion documentation. A setting that changes future behavior may leave previously stored information intact.

Can I make an adult-only agent suitable for a child by removing permissions?

No. Permissions and account eligibility are separate questions. An adult can prepare appropriate offline materials without handing an adult account to the child.

What should I do if an agent proposes an unexpected purchase or message?

Decline the action, inspect why it was proposed and check the relevant access or automation settings. If it already happened, handle the real-world result separately. Do not assume a corrected prompt reverses it.

Turn this check into a family routine

Start with one useful action today: write down every app your chosen agent can reach. Disconnect anything that is unnecessary for the next task.

For broader account preparation, read the free preview of Family AI Setup. For a parent-facing response when an AI gives an inappropriate or incorrect answer, see When AI Says Something Wrong. That guide is a family conversation resource, not incident-response support for an account breach.