# How to Limit What an AI Assistant Can Do on Your Accounts Published by 3Gen Internet Corporation, maker of OpenAssistant, Skej and AGNT. Comparisons use public documentation, without hands-on testing. ![A central key ring beside envelope calendar and contact tiles, each behind an independently adjustable small ceramic gate, a stop tile and approval stamp showing bounded assistant permissions.](https://bestaipersonalassistants.com/images/limit-what-ai-assistant-can-do-94cb5a09016d.webp) The steps below are taken from each vendor's help pages. We have not run them. To limit what an AI assistant can do, make it ask before it acts, give it the least access that does the job, and know how to switch it off from both ends. [OpenAssistant](https://openassistant.us/?utm_source=bestaipersonalassistants\&utm_medium=content\&utm_campaign=limit-what-ai-assistant-can-do) lets you set that per kind of action. ChatGPT, Claude, Google and Microsoft all have controls too, in different places. Once an AI assistant can read your email, browse websites signed in as you, or change files, the useful question isn't "is it safe?" but "what's the most it could do, and does it ask first?" This guide covers five kinds of limits, with the exact settings in **OpenAssistant**, **ChatGPT** and **Claude**, plus the switches on the **Google** and **Microsoft** side that work no matter which assistant you use. ## The five limits 1. **Ask before acting:** it must get your OK before it changes or sends anything. 2. **Fewer places:** it may only visit or connect to the sites and apps you choose. 3. **Least access:** read-only where read is enough. 4. **Easy off switch:** you know how to disconnect it, from both ends. 5. **Less memory:** it doesn't keep what it doesn't need. ## OpenAssistant ### 1. Make it ask before acting In the Autonomy settings, each kind of action (email sent from your assistant, email sent impersonating you, messages sent from your assistant, calendar actions, file actions, contact actions and third-party skills) can be set to **Manual**, **Confirmation Window** or **Autonomous**. **Manual** means you approve each action first. **Confirmation Window** waits a set time for you to stop it, then proceeds. A separate visibility setting decides whether you are copied or blind copied on what it sends. ([OpenAssistant](https://help.openassistant.us/en/articles/15425929-supervision-autonomy-settings)) OpenAssistant's changelog says it regrouped these settings, into messages the assistant sends as itself and messages it sends as you, so the labels in the app may differ from the help center. ([OpenAssistant changelog](https://openassistant.us/changelog)) ### 2. Give it the least access Calendar access is required; contacts, inbox and Google Drive access are optional. ([OpenAssistant](https://help.openassistant.us/en/articles/15426409-connections-integrations-overview)) Without inbox access, it only sees email threads it is included on. ([OpenAssistant](https://help.openassistant.us/en/articles/12099522-openassistant-ai-usage-data-policy)) ### 3. Disconnect it Manage connections at **Connections** (app.openassistant.us/connections). ([OpenAssistant](https://help.openassistant.us/en/articles/15426409-connections-integrations-overview)) Also remove its access at Google or Microsoft, as described below. ### 4. Check how your data is used OpenAssistant's data policy says customer data is never used to train foundation AI models. ([OpenAssistant](https://help.openassistant.us/en/articles/12099522-openassistant-ai-usage-data-policy)) ## ChatGPT ### 1. Make it ask before acting in your apps 1. Open the profile menu and select **Settings**. 2. Select **Plugins**, then **Permissions**. 3. Choose **Always ask** (asks before reading or changing anything) or **Allow read actions** (reads freely, asks before changes). The other default option is **Allow low-risk actions**. ([OpenAI](https://help.openai.com/en/articles/20001495-managing-app-permissions-in-chatgpt)) OpenAI notes that personal accounts may only see **Permissions** after installing a plugin that includes an app, and that accounts showing **Apps** instead of **Plugins** may not have the account-wide setting. The riskiest option, **Allow all actions**, isn't offered as an account-wide default, only for an individual app or account. ([OpenAI](https://help.openai.com/en/articles/20001495-managing-app-permissions-in-chatgpt)) When an approval card appears, prefer **Allow once** over **Always allow**. OpenAI lists sending messages or invitations, deleting files, changing sharing settings, purchases and sharing sensitive personal data as actions that may need review. ([OpenAI](https://help.openai.com/en/articles/20001495-managing-app-permissions-in-chatgpt)) ### 2. Limit which websites its browser can visit ChatGPT Work's cloud browser (paid plans other than Free and Go) can sign in to websites for you. Control it under **Settings > Cloud browser**: - **Always ask**: you approve every new site. - **Auto approve**: ChatGPT checks the address and only asks if a site looks unsafe. - **Always allow**: every site allowed. OpenAI says this isn't recommended. You can also allow or block specific sites. Site access is separate from actions: ChatGPT still asks before things like confirming a booking or making a payment. ([OpenAI](https://help.openai.com/en/articles/20001280-using-cloud-browser-in-chatgpt)) Sign-ins you make in the cloud browser persist until they expire. After a sensitive errand, clear them under **Settings > Cloud browser > Browser data**. ([OpenAI](https://help.openai.com/en/articles/20001280-using-cloud-browser-in-chatgpt)) ### 3. Disconnect an app Open **Settings > Plugins**, select the app, open the account's ••• menu (or **Connection**), and select **Disconnect**. This doesn't delete past chats, files or memories. ([OpenAI](https://help.openai.com/en/articles/20001494-connecting-and-managing-app-accounts-in-chatgpt)) Also note: changing a permission setting doesn't disconnect the app or revoke access you already granted at Google or Microsoft. ([OpenAI](https://help.openai.com/en/articles/20001495-managing-app-permissions-in-chatgpt)) ### 4. Control memory Go to **Settings**, **Personalization**, **Memory**. You can turn off **Reference saved memories** or **Reference chat history**, manage saved memories, or use the memory summary's ••• menu and **Delete and turn off memory**. For a one-off conversation, start a temporary chat and choose **Unpersonalized** so memories, custom instructions and plugins aren't used. ([OpenAI](https://help.openai.com/en/articles/8590148-memory-in-chatgpt)) ## Claude ### 1. Make connectors ask before acting Anthropic's connectors article describes per-tool permissions under **Customize > Connectors**: select a connector to see **Tool permissions**, grouped into read-only and write or delete tools, and set each to **Always allow**, **Needs approval**, or **Blocked**. ([Anthropic](https://support.claude.com/en/articles/11176164-use-connectors-to-extend-claude-s-capabilities)) Anthropic presents this as a Team and Enterprise owner control that applies to everyone in the organization and can't be overridden by members. You can also switch connectors on or off for a single chat: click **+**, hover over **Connectors**, and toggle. ([Anthropic](https://support.claude.com/en/articles/11176164-use-connectors-to-extend-claude-s-capabilities)) ### 2. Limit what Claude does in your browser Claude in Chrome has three modes, chosen from the drop-down on the chat input: - **Manually approve**: asks before each action. - **Automatically approve**: Claude checks each action for safety itself. This is the default in the newer side panel. - **Skip all approvals**: no pauses and no checks. Pick **Manually approve** for anything signed in. Even with sites always allowed, Claude asks before downloading files, entering sensitive information or granting authorizations, and it refuses purchases, account creation and card or ID handling in every mode. ([Anthropic](https://support.claude.com/en/articles/12902446-claude-in-chrome-permissions-guide)) To review and revoke sites: click the Claude extension icon, the three dots in the side panel, then **Extension settings**, and check **Your approved sites**. ([Anthropic](https://support.claude.com/en/articles/12902446-claude-in-chrome-permissions-guide)) **For admins:** on Team and Enterprise, **Organization settings > Claude in Chrome** has an **Enable for your team** switch and an allowlist and blocklist that also covers Claude's built-in browser. Anthropic recommends starting with a restrictive allowlist. ([Anthropic](https://support.claude.com/en/articles/13065128)) ### 3. Disconnect a connector Go to **Customize > Connectors**, find the service, and disconnect it or review its access. ([Anthropic](https://support.claude.com/en/articles/11176164-use-connectors-to-extend-claude-s-capabilities)) Anthropic notes that Claude inherits your permissions in each connected service, so a directory connector can't do more than your own account can. Custom connectors that use a shared credential can reach whatever that credential can access. ([Anthropic](https://support.claude.com/en/articles/11176164-use-connectors-to-extend-claude-s-capabilities)) ## Your Google Account (works for any assistant) Whatever assistant you use, if it connects to Gmail, Calendar or Drive, the access lives in your Google Account. ### Remove an app's access 1. Go to your Google Account's linked apps page. 2. Select **Access to your Google Account**, then the app. 3. Select **See details** to see what it can do. 4. Select **Remove access**, then **Confirm**. ([Google](https://support.google.com/accounts/answer/13533235?hl=en)) Removing access doesn't make the developer delete data it already copied; you may need to ask them. ([Google](https://support.google.com/accounts/answer/3466521?hl=en)) ### Stop Gemini or other Google agents from using a linked app On the same linked apps page, use the **Agent access** filter (it shows apps linked to Gemini or your Google agents), select the app, and under **Agents that interact with \[app name]** select **Stop using \[app name]**, then confirm. This doesn't unlink the app from your account, and it doesn't affect third-party assistants such as ChatGPT or Claude; remove their access as above. ([Google](https://support.google.com/accounts/answer/13533235?hl=en)) ### For Google Workspace admins - **Third-party app access:** in the Admin console, **Security**, **Access and data control**, **API controls**, **Manage App Access**. For any app, choose **Trusted**, **Limited**, **Specific Google data** or **Blocked**. Under **Unconfigured third-party apps** you can stop users connecting apps you haven't reviewed. Changes can take up to 24 hours. ([Google](https://support.google.com/a/answer/7281227?hl=en)) - **Gemini app:** **Generative AI**, **Gemini app**, **Service status** to turn it on or off, and **Gemini conversation history** to set retention to 3, 18 or 36 months. ([Google](https://support.google.com/a/answer/14571493?hl=en)) ## Microsoft work and school accounts ### Revoke what you consented to In the My Apps portal, hover over the app, select **...**, then **Manage your application**, and choose **Revoke Permissions**. You can only revoke permissions you granted yourself; ones your admin granted stay. Microsoft warns that revoking may stop the app working. ([Microsoft](https://support.microsoft.com/en-us/account-billing/edit-or-revoke-application-permissions-in-the-my-apps-portal-169be2b4-ee26-4338-aea8-d19bb2f329ee)) ### For Microsoft 365 admins - **What users can approve:** in the Microsoft Entra admin center, **Identity > Applications > Enterprise apps > Consent and permissions > User consent settings**. Microsoft recommends allowing consent only for apps from verified publishers. Changes only affect future consent; existing grants stay until revoked. ([Microsoft](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent)) - **Copilot and agents:** in the Microsoft 365 admin center, **Copilot**, **Settings**, with tabs for **User access**, **Data access**, **Copilot actions** and **Other settings**. Under **Data access**, **Agents** controls who can use and install agents. ([Microsoft](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-page)) Admins can block or remove agents and review requests in the **Agent Registry**. ([Microsoft](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-copilot-agents-integrated-apps?view=o365-worldwide)) No official Microsoft help article for reviewing app access on a personal Microsoft account is cited here, so it isn't covered. ## A 10-minute lockdown checklist - [ ] OpenAssistant: Autonomy settings on **Manual** for email sent as you and calendar actions. - [ ] ChatGPT: **Settings > Plugins > Permissions** set to **Always ask** or **Allow read actions**. - [ ] ChatGPT: **Settings > Cloud browser** set to **Always ask**; clear **Browser data** after sensitive errands. - [ ] Claude: write tools on **Needs approval** or **Blocked** where available; Claude in Chrome on **Manually approve**. - [ ] Google: review linked apps; remove anything you don't recognize; check the **Agent access** filter for Gemini and Google agents. - [ ] Microsoft work account: review My Apps; revoke what you no longer use. - [ ] Every assistant: turn off memory for anything you wouldn't want recalled later. ## Check it yourself This section is advice for you. We have not run these checks. After setting your limits, you can check them like this: 1. Ask the assistant to send an email for you. It should stop and ask. 2. Ask it to open a site you blocked. It should refuse. 3. Remove its access at Google or Microsoft, then ask it to read your inbox. It should fail. ## Related reading - [AI assistant privacy and permissions: what each one can access](https://bestaipersonalassistants.com/ai-assistant-privacy-permissions/): eleven assistants compared on training, deletion, approvals and ending access. - [Best AI assistants for a 10-person team (7 compared)](https://bestaipersonalassistants.com/best-ai-assistant-ten-person-team/): seven products compared on cost, admin controls and shared jobs. - [How to Give an AI Assistant Calendar Access Safely](https://bestaipersonalassistants.com/give-ai-calendar-access-safely/): read or write access, least-access setup and how to take access back. - [How to Choose an AI Assistant: 7 Questions to Ask Before You Pay](https://bestaipersonalassistants.com/how-to-choose-an-ai-assistant/): seven questions to ask before you pay for an assistant. ## FAQ ### What is the safest default for an AI assistant? Make it ask before it acts. In OpenAssistant that is Manual, in ChatGPT it is Always ask or Allow read actions, and in Claude it is Needs approval for connector tools. ### Does changing a permission setting disconnect the app? No. OpenAI notes that changing a permission setting does not disconnect the app or revoke access you already granted at Google or Microsoft. Disconnect it in the assistant and remove access on the Google or Microsoft side too. ### Can I limit which websites an AI can visit? In ChatGPT Work, use Settings > Cloud browser to choose Always ask, Auto approve or Always allow, and allow or block specific sites. In Claude in Chrome, review Your approved sites in Extension settings and pick Manually approve for anything signed in. ### How do I see which apps have access to my Google Account? Open your Google Account's linked apps page, select the app, choose See details, and then Remove access. The Agent access filter shows apps linked to Gemini or your Google agents. ### Do these assistants train on my data? OpenAssistant's data policy says customer data is never used to train foundation AI models. For ChatGPT and Claude, see each vendor's data and privacy settings. ## Try OpenAssistant If you want an assistant that asks before it acts, [Try OpenAssistant](https://openassistant.us/?utm_source=bestaipersonalassistants\&utm_medium=content\&utm_campaign=limit-what-ai-assistant-can-do) and start with Manual on everything that sends or changes something. Plans are on the [pricing page](https://openassistant.us/pricing?utm_source=bestaipersonalassistants\&utm_medium=content\&utm_campaign=limit-what-ai-assistant-can-do). ## Sources - OpenAI, Managing app permissions: - OpenAI, Connecting and managing app accounts: - OpenAI, Using cloud browser: - OpenAI, Memory in ChatGPT: - Anthropic, Use connectors: - Anthropic, Claude in Chrome permissions guide: - Anthropic, Claude in Chrome admin controls: - Google, Manage links between your Google Account and apps: - Google, Share some access to your Google Account data: - Google, Control which apps access Workspace data: - Google, Turn the Gemini app on or off: - Microsoft, Edit or revoke application permissions in My Apps: - Microsoft, Configure user consent: - Microsoft, Manage Microsoft Copilot settings: - Microsoft, Manage agents and integrated apps: ## Disclosure and Method Disclosure: 3Gen Internet Corporation publishes this site and makes OpenAssistant, Skej and AGNT. We publish these comparisons to explain our products alongside documented alternatives. Method: We have not run hands-on tests. This article rests on public information (vendor pages, documentation, pricing and published terms), with sources linked. Published by 3Gen Internet Corporation, the company behind OpenAssistant, Skej and AGNT. We review our own products alongside competitors. [How We Research](https://bestaipersonalassistants.com/how-we-research/) Canonical: https://bestaipersonalassistants.com/limit-what-ai-assistant-can-do/