What should an agent be allowed to touch?
Choose the apps, websites and approval setting for an agent in Claude, ChatGPT or Gemini, so anything that reads outside content must ask before it sends, pays or deletes.
Part of Safe by designTime about 20 minutes, with the try-itChecked 16 Oct 2026Done saved in this browser
Three things to take away
- 1
Every tool you connect is a decision about what this thing can reach, and every tool you leave out is a door that stays shut.
- 2
Four settings decide it: apps (read, or read and write), websites, approval mode, and tasks that run while you are away. Find them in the tool's settings, not in the chat.
- 3
Outside words, no power. An agent that reads outside content may not also send, pay or delete without asking.
Same idea, three tools (as of Oct 2026)
Each vendor uses its own words for the same settings.
| Claude | ChatGPT | Gemini | |
|---|---|---|---|
| A link to another app | Connector | App (installed inside a plugin) | Connected app |
| Where you manage them | Customize > Connectors | Settings > Plugins | Customize, or Settings > Connected Apps |
| Approval choices | Per tool: Always allow, Needs approval, Blocked. In chat: Allow once or Always allow | Always ask, Allow read actions, Allow low-risk actions, Allow all actions | Custom apps: every write action needs your confirmation. Task: asks before sending, buying or submitting forms |
| The careful start | Needs approval, then Allow once | Always ask, or Allow read actions | Confirm each change it asks about; remove apps you do not use |
| Signing in to websites | A built-in browser kept separate from your own logins | A cloud browser with a secure sign-in form the model cannot see | Task asks you to take over for sign-ins |
Worth knowing in each
- Claude: you set each tool inside a connector on its own, so a mail connector can search freely while sending stays at Needs approval or Blocked. And by default, Claude asks before it acts.
- ChatGPT: an app's permission can let it read without asking (Allow read actions), so you can use it for lookups while every change still waits for you.
- Gemini: every write action in a custom app needs your confirmation, and a task asks before it sends messages, makes purchases or submits forms. Its agent, Task, and its custom apps are for personal accounts only so far.
In your assistant
Menus move often, and your plan or your IT team may change what you see. If a setting is locked on a work account, write it down and ask IT.
Claude
- Approvals. Anthropic: "By default, Claude asks before taking an action." You can let it keep working and check in only when something needs a closer look; keep the default for anything new, sensitive or hard to undo. Source: Anthropic: Cowork is now Claude (16 Sep 2026).
- Apps (connectors), read or write. Go to Customize > Connectors. For each tool of a connector, choose Always allow, Needs approval or Blocked. In a chat, select "+", then Connectors, and switch on only the ones this task needs. When Claude asks to use a tool, choose "Allow once" until you trust it. On Team and Enterprise you may see "Request" until an owner adds the connector. Sources: Anthropic: Connectors overview; Anthropic help page
- Files. On the desktop app you choose the folders Claude may use. Give it one working folder for the job, not your whole drive. Source: Anthropic: Cowork overview
- Websites and your screen. Claude's built-in browser in the desktop app is kept "separate from your own browser, logins, and tabs" (Pro, Max and Team). Computer use, where Claude takes over the screen "only when it has to", is a research preview and asks permission for each app. Claude in Chrome is an extension on Pro, Max, Team and Enterprise. Sources: Anthropic: Cowork; Anthropic: Plans
- While you are away. Long tasks can carry on after you close the laptop, scheduled tasks repeat, and Dispatch (Pro and Max, desktop app, for people who already use it: Anthropic says it "isn't available to new users" of the new single Claude) runs background tasks. Check progress from your phone, and read each run. Sources: Anthropic: Cowork is now Claude; Anthropic: Dispatch; Anthropic: Claude Cowork and chat are one Claude
- Your own MCP link. A custom connector is added with "Add", then Custom, then Web, and the server address (Free is limited to one). Anthropic says custom connectors connect to services that "haven't been verified by Anthropic", so add one only if your company approves it. Sources: Anthropic: Connectors overview; Anthropic help page
ChatGPT
- Apps, read or write. Open Settings > Plugins and pick the app. Its permission is one of four: Always ask, Allow read actions, Allow low-risk actions or Allow all actions. While you learn, choose Always ask or Allow read actions, and avoid Allow all actions. Connect your work account for work data, never a personal one. Source: OpenAI: Apps in ChatGPT
- When it acts. In Work, follow its progress and "approve important actions" as they come up. Source: OpenAI: ChatGPT work and Codex
- Websites. Work's cloud browser opens websites for you, including sites you sign in to through a secure form the model cannot see, and it pauses for your sign-in or confirmation. On Plus and up, not Free or Go. Source: OpenAI: Using cloud browser in ChatGPT
- Passwords. Never paste a password, a security code or a card number into the conversation; use the secure sign-in form. Source: as above.
- While you are away. Scheduled Tasks run on a schedule or when something happens: a new Gmail message, a new Slack message or a GitHub pull request. A task that starts on outside email is reading outside words, so keep it to read and report. Source: OpenAI: ChatGPT work and Codex
- Your own MCP link. Developer mode (beta), on Plus and up. Leave it to IT unless your company approves it. Source: OpenAI: Plans
Gemini
- Apps. Open the left menu and click Customize to connect apps. For Gmail, Drive, Docs and Calendar, connect the Google Workspace app; on a work account, your admin decides which apps are allowed. Mention an app with @ when you want Gemini to use it, and remove apps you no longer use from Connected Apps. Sources: Google: Release notes (13 Oct 2026); Google: Gemini Help; Google: Gemini Help
- When it acts. Write actions in a custom app always need your confirmation, and a task asks before it sends messages, makes purchases or submits forms. Google does not say this for every connected app. Sources: Google: Gemini Help; Google: Gemini Help
- The agent (Task), personal accounts. It can use your own Chrome or a remote browser in the cloud. For sign-ins it asks you to take over, and some actions need your confirmation. Google advises not to type passwords or payment details into the task. Source: Google: Gemini Help
- Your own MCP link (a custom app). On the web only, for personal accounts, 18 or over, in the US and in English. Google says it "does not control, monitor, or secure third-party MCP servers". Source: Google: Gemini Help
- At work. On a work or school account, the admin controls these features. Source: Google: Gemini Help
The UK cyber agency's checklist
The UK National Cyber Security Centre's interim advice of 20 Aug 2026, written for the people who design and run agent systems, is a sound checklist for any team:
- Decide how much autonomy the agent needs: people approve each action, people watch and can step in, or no human review.
- Make a named person or group responsible for what it does.
- Keep human oversight, and watch what it does so it can be stopped.
- Log, audit and monitor its activity.
- Run it in a sandbox and restrict its network access.
- Keep the ability to "pull the plug" and halt it at once.
- Do not rely on prompting alone: combine instructions with technical and operational controls.
Which to start with, and my pick
An honest view, for an agent you are still learning to trust (as of Oct 2026):
- Claude asks before acting by default and lets you set every connector tool on its own, down to Blocked. Anthropic also reports Opus 5.5 is harder to steer with hidden instructions; that is its own claim.
- ChatGPT has four clear app permission levels, and a cloud browser whose sign-in form the model cannot see.
- Gemini makes every write action in a custom app wait for you, and its tasks ask before sending, buying or submitting a form, but its agent and custom apps are for personal accounts only so far.
My recommendation: Claude first, ChatGPT second, Gemini third.
For a new agent job, Claude's default of asking first makes the careful start the easy one. Whichever you use, use the tool your company approves, with approvals on.
Try it (10 minutes)
Use one agent or assistant you already use at work. You will only look at settings. Nothing gets pasted anywhere.
- Open its settings, not a chat (2 minutes). In Claude: Customize > Connectors. In ChatGPT: Settings > Plugins. In Gemini: Customize, or Settings > Connected Apps.
- Make four rows on paper: Apps, Websites, Approval setting, Away tasks (5 minutes).
- Apps: list each connection and mark it R (read only) or W (can change things).
- Websites: write how it signs in and when it asks.
- Approval setting: write the current setting.
- Away tasks: list every scheduled or triggered task.
- Circle every connection that reads outside content: outside email, the web, files others sent (1 minute).
- For any circle that also has a W, change it to ask first, or switch the write off. If the setting is locked, write it down for IT (2 minutes).
Check yourself
-
1Your agent summarises supplier emails each morning and can also send replies. What matters most?
The answer: B It reads outside content, so a typed request is not a reliable gate; the stop has to be set in the tool. -
2You connect your calendar app in ChatGPT. Which permission is the careful one while you learn (as of Oct 2026)?
The answer: B Keep it asking, or let it only read, until you trust it. Allow all actions lets everything through. -
3Gemini's Task reaches a website that needs you to sign in. What should happen?
The answer: B For sign-ins, Google says Task asks you to take over, and it advises against typing passwords or payment details into a task. The same rule holds in all three tools.
Read the whole lessonThe idea in full, the worked examples, common mistakes and what to check
The idea
An agent is the same kind of model you already chat with, given three things: a goal, a set of tools, and permission to keep going. The tools are what make it useful, and they are also what make it risky.
Every tool you connect is a decision about what this thing can reach, and every tool you leave out is a door that stays shut.
Anthropic puts the risk in two parts: what the agent can read and see, and what it is allowed to do. When something goes wrong, Anthropic says, the impact depends almost entirely on those two things.
Here is why that matters at work. An agent reads whatever its tools bring back, so a web page or an email can slip instructions into the loop. It's called prompt injection, and nobody has fully solved it yet. You cannot control what a stranger writes in an email to you. You can control what your agent is allowed to do after reading it.
An illustration, not a real case: a sales coordinator connects an agent to the team's shared inbox and the customer list, so it can log new enquiries each morning. The inbox is full of mail from people outside the company. If the same agent may also send replies and edit records without asking, then one planted line in one email can reach your customers. Let it read the inbox and draft the entries, make every send ask first, and the same planted line meets a person before it meets a customer.
Defaults are often looser than people assume, and the loosest choice is always one click away: ChatGPT offers "Allow all actions" for a connected app, and Claude offers "Always allow" for each connector tool. Open the settings and read what yours say.
A better model helps, but it is not a lock. Anthropic reports that Claude Opus 5.5 resists hidden instructions better and is less likely to take hard-to-reverse actions (as of Oct 2026). That is the vendor's own claim, and it makes your settings no less important.
The four settings
Every agent, in every tool, comes down to four settings. Find them in the tool's settings pages, not in the chat.
1. Apps: read, or read and write? For each connected app (email, calendar, files, the customer system), ask whether the agent can only read, or can also change things: send, edit, move, delete. Put simply: what you connect, it can touch. Connect your calendar and it can read it; leave your bank out and it cannot reach it. Switch off any connection the job does not need.
2. Websites. Which sites may it open, and who signs in? The safe setting asks you before it acts on a site, and you type any password yourself, into the site, never into the chat.
3. Approval setting. When must it stop and ask you? Asking first covers anything you can't undo, like sending, paying or deleting. Set this in the tool, not as a sentence in your brief: a typed request alone is not a reliable gate, because a planted instruction can tell the agent to ignore it.
4. Tasks that run while you are away. Scheduled tasks, tasks that start when an email arrives, and long tasks that carry on after you close the laptop all work when nobody is watching. Keep them to read, report and draft: do not schedule a task that sends messages for you, buys anything or does anything hard to undo, and review the results after each run.
The plain rule
Outside words, no power. An agent that reads outside content (the web, outside email, files others sent) may not also send, pay or delete without asking.
This is Anthropic's own two-part test in everyday words: a prompt injection attack needs the agent both to read information from outside your trusted boundary and to be able to take actions that could harm you. Take away either one and, Anthropic says, the attack becomes more difficult.
Never give an agent a password, a security code or payment details in the chat or in a brief. All three tools build for this in their own way (as of Oct 2026): ChatGPT's cloud browser gives you a secure sign-in form the model cannot see; Gemini's Task asks you to take over for sign-ins, and Google advises against typing passwords or payment details into a task; Claude's built-in browser is kept separate from your own browser and logins. The rule is the same everywhere: you type passwords yourself, into the site, never into the chat.
A simple way to choose a level. Neosaipien uses four levels across its kits:
- Read: it looks and reports. It changes nothing and sends nothing.
- Draft: it drafts. Only you send or share.
- Ask first: it acts, and asks before each send, pay, delete or change.
- Alone: it acts inside fixed limits, and you review after.
Three questions set the ceiling for a job. Take the lowest level any of them allows.
- Can it be undone easily? If not: level 3 at most.
- Does it leave the team (a customer, a supplier, the public, money)? If so: level 3 at most, and a person presses send.
- Does it read outside content? If so: it must not also send, pay or delete without asking.
Start every new job at level 1 or 2, whatever its ceiling. Move up one level after five clean runs; move down at once after a surprise.
Common mistakes
- Typing the limit into the brief ("don't send anything") and treating it as a lock. A planted instruction can undo a typed one. Set it in the tool.
- Leaving the settings unread. The loosest choices, ChatGPT's Allow all actions and Claude's Always allow, are one click away.
- Choosing "Always allow" on the first prompt. In Claude, choose Allow once until you trust the tool.
- Connecting everything just in case. Each connection is a door. Close the ones the job does not need.
- Connecting a personal account for work data. Use your work account, and the tool your company approves.
- Adding a custom connector nobody checked. Anthropic says custom connectors connect to services that "haven't been verified by Anthropic", and Google says it does not secure third-party MCP servers.
- Scheduling a task that sends or pays, then never looking at its runs.
- Pasting a password, a security code or a card number into the chat.
- Trusting the model instead of the settings. A model that resists hidden instructions better is still not a lock.
What to check before you trust it
- The settings page, not the chat, says ask first for send, pay and delete.
- Every connection that can write is one the job needs, and none of them sits behind one that reads outside content without an approval.
- You type every password into the site yourself, and the agent never sees one.
- Every task that runs while you are away has an owner, and someone reviews each run.
- You know where pause and stop are, and you have tried them once.
- A named person is responsible for what the agent does.
- These steps cut the risk, they do not end it.
Check it. After the first runs, read what it did, step by step, not just the summary at the end. That is the next lesson.
Keep it safe. Outside words, no power. And never give it a password, a security code or payment details.
Checked against · read 16 Oct 2026Every claim, its source and the date read
As of: product steps as they were on the vendors' own pages on 16 Oct 2026.
Every product name, setting and step above comes from Neosaipien's platform reference, checked on these vendor pages on 16 Oct 2026.
- Anthropic, Introducing Claude Opus 5.5 (22 Sep 2026)
- Anthropic, Claude Cowork and chat are now one Claude (16 Sep 2026)
- Anthropic, Claude Cowork product page and FAQ
- Anthropic, Cowork overview
- Anthropic, Run tasks in the background with Dispatch
- Anthropic, Claude Cowork and chat are one Claude (help page; Dispatch not offered to new users of the new single Claude)
- Anthropic, Get started with connectors
- Anthropic, Use the connectors directory
- Anthropic, Claude plans
- Anthropic, Use Claude Cowork safely (the two-part risk and the two conditions for prompt injection)
- OpenAI, Connected apps in ChatGPT
- OpenAI, ChatGPT Work and Codex
- OpenAI, Using cloud browser in ChatGPT
- Google, Gemini Apps release notes (13 Oct 2026, Customize)
- Google, Connect and manage custom apps for Gemini Apps
- Google, Use apps connected to Gemini with a work or school account
- Google, Use Gemini Apps with a work or school Google Account
- Google, Manage your tasks and workflows in Gemini Apps
- UK NCSC, Managing the cyber risk of agentic AI (20 Aug 2026)
Not legal advice. Where this lesson mentions guidance or rules, it gives plain-English orientation only; your organisation's own policy comes first.
Where next
How do you review an agent's work before it goes out?
Check an agent's run against its brief in Claude, ChatGPT or Gemini, see exactly what it changed, and decide what can go out.
Open the next lessonThe Agent Playbook. Its dated insert and four "set the brakes" cards hold each tool's settings in one place, for a manager whose team's assistants now send, book, edit and run on a schedule.
AI implementation. AI put to work inside the tools you already run.
Book a 20-minute call