What Can Your Agent Do Without Asking?

It is a Monday morning. An analyst at a financial services firm messages a security engineer. A few weeks ago the analyst installed an open-source assistant called OpenClaw. It connects to email and calendar, and it is amazing. But it might have access to a lot.

It does. It holds OAuth tokens to Gmail, Google Calendar and Slack, and a browser session logged into the company's CRM. Nobody in IT knew. And the analyst has shown it to the whole team.

For two years the conversation was about chatbots: text in, text out, contained. Agentic assistants are different. They listen across your channels, interpret context and execute. They hold tokens, sessions and credentials. They operate.

The risk is structural

Put everything in one place and you get privilege concentration: compromise the agent and you lose operational control, not just data. Let it read messages and act on them and you get untrusted input with side effects. OpenClaw's own documentation warns to treat inbound messages as untrusted, because whoever can influence what the agent sees can influence what it does. The most common failures are not exotic. They are operational: a control panel exposed to the internet, OAuth scopes broader than anything needs.

None of this is specific to one product. It is the category.

Approval belongs where wrong is expensive

The delegation ladder says two questions set the rung: how much of the judgment is written down where the machine can read it, and how expensive is wrong, and how fast would you find out. An agent that can send, pay, delete or change permissions has answered the second question for you, and usually badly. Wrong is expensive and you find out late.

So require your own approval for anything irreversible. Configure confirmation for sends, deletes, payments, permission changes and external calls. If the agent can do it without asking, you have delegated authority you may regret. Scope tokens narrowly, read-only where possible, and revoke what you are not using. Run it somewhere isolated. The blast radius of a compromise is whatever the agent can reach.

The line moved when you installed it

The handoff line is the boundary between work that is safe to hand off and work that is not, and it moves without announcing itself. Connecting an assistant to your inbox moves it a long way in one click. Letting it read your calendar was one handoff. Letting it answer on your behalf, based on a message someone else wrote, is a different one, and nothing about the moment looks different.

The test is short. Pick any agent you are running now. If someone compromised this machine, what could they do with the tokens it holds? What can it do without asking you first? If the answer is longer than you expected, that is where the risk lives. Tighten the scope today.

If the assistant can act, someone has to be accountable for what it does.

Adapted from The Assistant That Can Act in The Forward View. Read the full issue.