Best AIPersonal Assistants
HomeResearch & guides

How to Limit What an AI Assistant Can Do on Your Accounts

Published by 3Gen Internet Corporation, maker of OpenAssistant, Skej and AGNT. Comparisons use public documentation, without hands-on testing.

A central key ring beside envelope calendar and contact tiles, each behind an independently adjustable small ceramic gate, a stop tile and approval stamp showing bounded assistant permissions.

The steps below are taken from each vendor’s help pages. We have not run them.

To limit what an AI assistant can do, make it ask before it acts, give it the least access that does the job, and know how to switch it off from both ends. OpenAssistant lets you set that per kind of action. ChatGPT, Claude, Google and Microsoft all have controls too, in different places.

Once an AI assistant can read your email, browse websites signed in as you, or change files, the useful question isn’t “is it safe?” but “what’s the most it could do, and does it ask first?” This guide covers five kinds of limits, with the exact settings in OpenAssistant, ChatGPT and Claude, plus the switches on the Google and Microsoft side that work no matter which assistant you use.

The five limits

  1. Ask before acting: it must get your OK before it changes or sends anything.
  2. Fewer places: it may only visit or connect to the sites and apps you choose.
  3. Least access: read-only where read is enough.
  4. Easy off switch: you know how to disconnect it, from both ends.
  5. Less memory: it doesn’t keep what it doesn’t need.

OpenAssistant

1. Make it ask before acting

In the Autonomy settings, each kind of action (email sent from your assistant, email sent impersonating you, messages sent from your assistant, calendar actions, file actions, contact actions and third-party skills) can be set to Manual, Confirmation Window or Autonomous. Manual means you approve each action first. Confirmation Window waits a set time for you to stop it, then proceeds. A separate visibility setting decides whether you are copied or blind copied on what it sends. (OpenAssistant) OpenAssistant’s changelog says it regrouped these settings, into messages the assistant sends as itself and messages it sends as you, so the labels in the app may differ from the help center. (OpenAssistant changelog)

2. Give it the least access

Calendar access is required; contacts, inbox and Google Drive access are optional. (OpenAssistant) Without inbox access, it only sees email threads it is included on. (OpenAssistant)

3. Disconnect it

Manage connections at Connections (app.openassistant.us/connections). (OpenAssistant) Also remove its access at Google or Microsoft, as described below.

4. Check how your data is used

OpenAssistant’s data policy says customer data is never used to train foundation AI models. (OpenAssistant)

ChatGPT

1. Make it ask before acting in your apps

  1. Open the profile menu and select Settings.
  2. Select Plugins, then Permissions.
  3. Choose Always ask (asks before reading or changing anything) or Allow read actions (reads freely, asks before changes). The other default option is Allow low-risk actions.

(OpenAI)

OpenAI notes that personal accounts may only see Permissions after installing a plugin that includes an app, and that accounts showing Apps instead of Plugins may not have the account-wide setting. The riskiest option, Allow all actions, isn’t offered as an account-wide default, only for an individual app or account. (OpenAI)

When an approval card appears, prefer Allow once over Always allow. OpenAI lists sending messages or invitations, deleting files, changing sharing settings, purchases and sharing sensitive personal data as actions that may need review. (OpenAI)

2. Limit which websites its browser can visit

ChatGPT Work’s cloud browser (paid plans other than Free and Go) can sign in to websites for you. Control it under Settings > Cloud browser:

You can also allow or block specific sites. Site access is separate from actions: ChatGPT still asks before things like confirming a booking or making a payment. (OpenAI)

Sign-ins you make in the cloud browser persist until they expire. After a sensitive errand, clear them under Settings > Cloud browser > Browser data. (OpenAI)

3. Disconnect an app

Open Settings > Plugins, select the app, open the account’s ••• menu (or Connection), and select Disconnect. This doesn’t delete past chats, files or memories. (OpenAI) Also note: changing a permission setting doesn’t disconnect the app or revoke access you already granted at Google or Microsoft. (OpenAI)

4. Control memory

Go to Settings, Personalization, Memory. You can turn off Reference saved memories or Reference chat history, manage saved memories, or use the memory summary’s ••• menu and Delete and turn off memory. For a one-off conversation, start a temporary chat and choose Unpersonalized so memories, custom instructions and plugins aren’t used. (OpenAI)

Claude

1. Make connectors ask before acting

Anthropic’s connectors article describes per-tool permissions under Customize > Connectors: select a connector to see Tool permissions, grouped into read-only and write or delete tools, and set each to Always allow, Needs approval, or Blocked. (Anthropic)

Anthropic presents this as a Team and Enterprise owner control that applies to everyone in the organization and can’t be overridden by members.

You can also switch connectors on or off for a single chat: click +, hover over Connectors, and toggle. (Anthropic)

2. Limit what Claude does in your browser

Claude in Chrome has three modes, chosen from the drop-down on the chat input:

Pick Manually approve for anything signed in. Even with sites always allowed, Claude asks before downloading files, entering sensitive information or granting authorizations, and it refuses purchases, account creation and card or ID handling in every mode. (Anthropic)

To review and revoke sites: click the Claude extension icon, the three dots in the side panel, then Extension settings, and check Your approved sites. (Anthropic)

For admins: on Team and Enterprise, Organization settings > Claude in Chrome has an Enable for your team switch and an allowlist and blocklist that also covers Claude’s built-in browser. Anthropic recommends starting with a restrictive allowlist. (Anthropic)

3. Disconnect a connector

Go to Customize > Connectors, find the service, and disconnect it or review its access. (Anthropic) Anthropic notes that Claude inherits your permissions in each connected service, so a directory connector can’t do more than your own account can. Custom connectors that use a shared credential can reach whatever that credential can access. (Anthropic)

Your Google Account (works for any assistant)

Whatever assistant you use, if it connects to Gmail, Calendar or Drive, the access lives in your Google Account.

Remove an app’s access

  1. Go to your Google Account’s linked apps page.
  2. Select Access to your Google Account, then the app.
  3. Select See details to see what it can do.
  4. Select Remove access, then Confirm.

(Google) Removing access doesn’t make the developer delete data it already copied; you may need to ask them. (Google)

Stop Gemini or other Google agents from using a linked app

On the same linked apps page, use the Agent access filter (it shows apps linked to Gemini or your Google agents), select the app, and under Agents that interact with [app name] select Stop using [app name], then confirm. This doesn’t unlink the app from your account, and it doesn’t affect third-party assistants such as ChatGPT or Claude; remove their access as above. (Google)

For Google Workspace admins

Microsoft work and school accounts

Revoke what you consented to

In the My Apps portal, hover over the app, select …, then Manage your application, and choose Revoke Permissions. You can only revoke permissions you granted yourself; ones your admin granted stay. Microsoft warns that revoking may stop the app working. (Microsoft)

For Microsoft 365 admins

No official Microsoft help article for reviewing app access on a personal Microsoft account is cited here, so it isn’t covered.

A 10-minute lockdown checklist

Check it yourself

This section is advice for you. We have not run these checks.

After setting your limits, you can check them like this:

  1. Ask the assistant to send an email for you. It should stop and ask.
  2. Ask it to open a site you blocked. It should refuse.
  3. Remove its access at Google or Microsoft, then ask it to read your inbox. It should fail.

FAQ

What is the safest default for an AI assistant?

Make it ask before it acts. In OpenAssistant that is Manual, in ChatGPT it is Always ask or Allow read actions, and in Claude it is Needs approval for connector tools.

Does changing a permission setting disconnect the app?

No. OpenAI notes that changing a permission setting does not disconnect the app or revoke access you already granted at Google or Microsoft. Disconnect it in the assistant and remove access on the Google or Microsoft side too.

Can I limit which websites an AI can visit?

In ChatGPT Work, use Settings > Cloud browser to choose Always ask, Auto approve or Always allow, and allow or block specific sites. In Claude in Chrome, review Your approved sites in Extension settings and pick Manually approve for anything signed in.

How do I see which apps have access to my Google Account?

Open your Google Account’s linked apps page, select the app, choose See details, and then Remove access. The Agent access filter shows apps linked to Gemini or your Google agents.

Do these assistants train on my data?

OpenAssistant’s data policy says customer data is never used to train foundation AI models. For ChatGPT and Claude, see each vendor’s data and privacy settings.

Try OpenAssistant

If you want an assistant that asks before it acts, Try OpenAssistant and start with Manual on everything that sends or changes something. Plans are on the pricing page.

Sources