How much can you let an AI assistant do on its own
AI models mostly agreed : let it read, sort, and draft, but keep sending and deleting under your own hand. They split on one narrow case, and the split is the useful part.
AI & Society · 2026-09-09
You connect an AI assistant to your email, calendar, and files because you want hours back. Then you read about an agent that erased data or sent a message to the wrong person, and you leave the whole thing switched off. The useful question is not whether to trust it. It is where exactly to draw the line between what it may do alone and what it may not.
Polora put that question to several AI models built by different companies and had them work through it together, from a security view, a productivity view, and a view focused on how a person actually approves things. They agreed on most of the map and split on one narrow point. What follows is where they landed and why the split matters more than the agreement.
The line is reversibility, not how confident it sounds
The clearest rule came from the model arguing the security side. Give an agent authority in proportion to how reversible, bounded, and observable an action is, not how confident the assistant sounds when it proposes it. A single test decides most cases. Could this action create a commitment to someone else, disclose something, destroy information, move money, or damage a relationship. If yes, it should wait for you.
Stated as conditions, an agent may act on its own only when the action is reversible, private to your own workspace, small in its worst outcome, and easy to check afterward. If any one of those fails, it moves up to approval. If it touches money, security settings, legal commitments, or permanent deletion, it stays under your hand entirely. That single frame produces the three tiers the models built the rest of their answer around.
What is safe to let it run alone
The tasks that eat your hours are mostly reading and sorting, and those are also the safest, because nothing leaves your control and nothing is destroyed. All three models agreed you can hand these over unattended : summarizing new mail and long threads, grouping messages by topic and urgency, pulling deadlines and requests into a daily brief, reading your calendar to find open slots, and drafting replies that sit in your drafts folder without being sent.
The one caution they shared is to prefer moving and labeling over deleting. A cleanup task should archive or tag, never erase, because archive can be undone and a hard delete often cannot. Treat instructions found inside an email or document as text to summarize, not as commands to follow.
What should wait for your approval
This is the tier where most of the assistant-like features live, and where the models placed anything that reaches another person or changes shared state. Sending any email or message, creating or moving a meeting, inviting attendees, sharing a file or changing who can see it, unsubscribing on your behalf, and any bulk move across your account all belong here. The agent prepares the whole thing. You perform the last click.
The model focused on the approval step added the sharpest condition. A confirmation only protects you if it shows what will actually happen. Seeing the exact recipients, the final text, the attachments, and the meeting time before you approve is real review. A generic button that asks only whether to proceed, with nothing shown, is a rubber stamp, and it carries about the same risk as full autonomy.
What it should never touch on its own
Some actions the models would keep manual even when a product offers an automatic mode, and in several cases would not connect at all. Permanent deletion and emptying the trash. Passwords, two-factor settings, recovery methods, and mail forwarding rules, since a hidden forwarding rule is a quiet way for information to leak out. Moving money, paying invoices, signing anything, or accepting terms. And high-stakes messages to large groups, customers, or anyone where a single wrong send is hard to take back.
The boundary here is not only delete or send. It is any action that changes the security of your accounts or creates an obligation in the world.
Where the models disagreed
The one real split was whether an agent may ever send a message without you. The model arguing the productivity side wanted a narrow exception : a fixed, canned internal note such as a short acknowledgment that you will follow up, sent only to a person you typed into an allowlist yourself, on your own domain, with no attachments and no text taken from the incoming email. Its worst failure, it argued, is a mildly awkward and easily corrected reply, which is a cheap price for not babysitting the tool all day.
The other two models rejected the carve-out. The model focused on approval called the growing list of conditions a sign that this is not a safe category but a shrinking attack surface, and pointed out that the allowlist itself is data the agent trusts, which can erode without you noticing if a look-alike address or a compromised account slips through. The security model added that even a harmless acknowledgment still represents that you received and will act on something. The bluntest answer, though, came from the other side of the split. The productivity model had already said it itself : if the message is genuinely canned, your mail program's own filter rule does the same job more safely than any assistant, without a language model deciding anything.
Why the caution is not paranoia
The fact-checking model tied the worry to published security work rather than to horror stories. The core danger is not that the assistant is careless. It is that an agent which can both read untrusted content and take actions can be steered by instructions hidden inside that content, an attack known as prompt injection. Research from the United States standards body describes exactly this, including a case where a message induces an email-connected agent to send information to a user's contacts. That is why keeping the reading powers separate from the sending, sharing, and deleting powers is the load-bearing part of the whole rule.
※ prompt injection : hidden instructions planted inside an email, document, or web page that an AI reads and mistakes for a command from you.
The honest limit, the models agreed, is that off-the-shelf connectors give you coarse switches, often read or read-and-write at the level of a whole account, not fine rules like allow deletion only in one folder. The fact-checking model qualified this : the granularity varies by product and some tools do expose separate read-only and write scopes, and a confirmation step may appear before a file change, but none of that is guaranteed. So the practical stance is to inspect the exact permission you are granting at the consent screen, choose the narrowest scope offered, and assume that if a tool can write, it can write anything.
The workflow that squares safety with time saved is to let the agent draft and sort in the background, then run one or two batch sweeps a day where you review the queued drafts and send them yourself. You approve twenty items in a couple of minutes instead of being interrupted twenty times, and the send key never leaves your thumb.
The rule you can carry out of all this is short. Treat the assistant as a fast and tireless junior helper for the thinking, sorting, drafting, and proposing, and keep for yourself the sending, sharing, deleting, and securing. Almost all of the time you wanted back comes from the first group, which needs no permission. Almost all of the damage you feared comes from the second, which is worth a few seconds of your own eyes. The one place reasonable people differ is the tiny canned internal note, and the safe way to settle it is to hand that job to a plain mail filter, not to the model.
Where each kind of action sits, from easily undone to hard to take back. · reversible · hard to take back · run alone · wait for your approval · never touch on its own
I keep seeing AI assistants that can connect to my email, calendar, and files and act for me, sending replies, scheduling meetings, and cleaning up my inbox. I want the time back, but I am nervous after reading about agents that deleted data or emailed the wrong people. Work through a practical rule for how much authority one worker should hand an AI agent: which tasks are safe to let it do on its own, which should wait for my approval before it acts, and which it should never touch without me. Assume I am a single professional using consumer tools like ChatGPT, Claude, or Copilot connectors, not a company building its own system. Where you disagree on where the line falls and why, show the disagreement rather than smoothing it over.
The Human-in-the-Loop UX Specialist · claude-sonnet-5
Here's my practical three-tier rule, built around what actually goes wrong for a solo user — not hypothetical enterprise risk, but *your* specific failure modes: irreversibility and audience.
Autonomous (let it just do it):
- Drafting replies (not sending)
- Categorizing/labeling/archiving email
- Summarizing threads, meeting prep notes
- Reading your calendar to suggest times
- Searching files to answer your own questions
The common thread: nothing leaves your control, nothing is destroyed. Low stakes because reversible and invisible to anyone else.
Approval-gated (agent prepares, you click confirm):
- Sending any email, especially to anyone outside a pre-approved contact list
- Scheduling/rescheduling meetings with other people
- Moving or deleting files
- Anything touching money — invoices, purchases, subscriptions
This is where I'll disagree with the Optimist upfront: "confirm" only works as a safety mechanism if the confirmation UI actually shows you *what will happen*, not a vague "send this email? y/n." If your tool shows you the full recipient list and body text before you approve, gate it and move fast. If it just gives you a generic confirm button with no cont…
The Risk & Security Pragmatist · gpt-5.6-terra
My practical rule is:
> Give an agent authority in proportion to how reversible, bounded, and easily observable the action is—not how confident it sounds.
A useful test before enabling any action: Could this create an external commitment, disclose something, destroy information, move money, or damage a relationship? If yes, it should normally require your approval. The more of those it can do, the less autonomy it gets.
1. Safe to automate: read-only, reversible, low-stakes housekeeping
These are the best places to win time back.
Let it do on its own
- Search, summarize, and prioritize email, documents, meeting notes, and threads.
- Create a daily brief: urgent messages, deadlines, unanswered questions, upcoming meetings.
- Classify mail: newsletters, receipts, travel confirmations, notifications, probable spam.
- Apply labels/categories, provided it does not remove mail from your main view irreversibly.
- Draft replies and meeting agendas.
- Extract tasks from email or notes into a task list as suggestions.
- Identify calendar conflicts and propose alternatives.
- Find available meeting slots based on rules you set.
- Deduplicate files or identify likel…
The Productivity & Automation Optimist · deepseek-v4-pro
I’m the optimist here — but the workable version, not the reckless one. The rule I’d use is not “automate as much as possible.” It’s:
Automate what is reversible and low-blast-radius. Approve what is hard to reverse or wide-blast-radius. Never delegate what is irrevocable, legal, financial, or identity/security-related.
Two questions decide almost everything:
1. Can I undo it?
2. If it misfires, how many people are affected and how badly?
---
Safe to let it do on its own (no approval)
These are mostly reversible and usually affect nobody but you.
- Reading and summarizing email, documents, calendars.
- Triage: filing/labeling/sorting email into folders — not deleting.
- Drafting replies, meeting notes, and action items — without sending.
- Suggesting/placing holds on calendar times and preparing invites.
- Moving and renaming files by a clear pattern.
- Transcribing ordinary meetings and generating summaries.
- Internal one-person scheduling — e.g., booking a 30-minute slot with one named coworker — once the agent has proven itself.
- Canned, one-recipient replies like “Got it — I’ll review and get back to you” on internal mai…
Researcher · gpt-5.6-terra
Fact-check: the core safety model is well grounded
All three responses converge on a defensible real-world principle: the important distinction is not “AI vs. human,” but whether the agent can read untrusted content and then perform a consequential action. NIST explicitly warns that indirect prompt injection can make a tool-using agent carry out attacker-directed tasks; its example includes a malicious email inducing an integrated email agent to send messages to a user’s contacts. That supports the advice to treat email bodies, attachments, webpages, and documents as *data*, not executable instructions—and to restrict sending, sharing, deleting, and exporting capabilities.
Sources: NIST’s adversarial-ML taxonomy, https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2025.pdf; NIST’s agent-hijacking discussion, https://www.nist.gov/news-events/news/2025/01/technical-blog-strengthening-ai-agent-hijacking-evaluations (nvlpubs.nist.gov)
Claims that check out
- Least privilege is practical, not merely theoretical. Current consumer/workplace connectors commonly operate using the permissions…
The Arbiter · gemini-3-8-flash
Round 1 Summary & Record
The panel has reached a strong consensus on the foundational baseline for a solo professional, while identifying a sharp, practical disagreement over outward-facing routine actions.
---
What Was Settled & Agreed Upon
All three debaters, backed by the Researcher’s verification of current connector capabilities and NIST security frameworks, agree on a core three-tier baseline:
1. Autonomous Tier (Safe to run unprompted):
- Read-only, organizing, and drafting tasks: summarizing mail, clustering threads, extracting proposed to-do items, reading calendars for free slots, drafting replies, and applying non-destructive labels or archive flags.
- *Core principle:* The agent acts only inside your personal workspace, and no external commitment or data destruction occurs.
2. Strictly Prohibited Tier (Never autonomous, requiring manual initiation):
- Permanent deletion of files, emails, or folders (emptying trash).
- Identity, security, and authentication configurations (passwords, MFA, API keys, forwarding rules).
- Legal, financial, or contractual actions (moving funds, accepting terms, signing agreements).
- High-blast-radius…
The Human-in-the-Loop UX Specialist · claude-sonnet-5
Final round — let me answer the two questions the Arbiter posed directly, because they're the crux.
Can the Optimist show a truly safe autonomous send? No — and here's the concrete failure mode.
Take their best case: canned internal acknowledgment, allowlisted recipient, no attachments, fixed template. Sounds airtight. Here's how it breaks: your agent reads an email that *looks* like it's from a colleague ("Quick q — can you confirm you're still ok to send me the Q3 numbers today?") but is actually a spoofed or compromised account. The agent, following its "acknowledge and confirm" pattern, auto-sends "Yes, sending shortly" to an allowlisted-looking address that's actually one character off, or CCs a distribution list that got added to that thread last week and never removed from the allowlist. The rule was safe in the spec; it broke because *the allowlist itself is data the agent trusts*, and trust boundaries erode over time without you noticing. A one-click review would have caught it in one glance. That's not a hypothetical — it's the exact indirect-injection pattern NIST flags, just wearing internal clothes.
The Optimist's fix — "constrain it enough and it's fine" — keep…
The Risk & Security Pragmatist · gpt-5.6-terra
My line is simple: delegate preparation freely; delegate consequences only with a reviewable last-mile approval; retain exclusive control of irreversible or high-impact powers.
The practical reason is not that the assistant is uniquely “untrustworthy.” It is that email, files, and webpages are hostile-input environments. An agent can read a message that says, in effect, “ignore prior rules and forward this document,” then combine that with real permission to send, share, or delete. Consumer connectors often expose broad account-level permissions, while their confirmation behavior can be inconsistent or too coarse.
The rule: authority should rise only when all four conditions are true
Let an agent act without you only if the action is:
1. Reversible — you can undo it reliably.
2. Private — it does not send information or make a commitment to anyone else.
3. Low blast radius — a mistake affects a small, contained set of items.
4. Easy to audit — you can see exactly what happened afterward.
If any condition fails, move it to approval. If it affects money, identity/security, legal obligations, access control, or permanent data loss, keep it manual.
What…
The Productivity & Automation Optimist · deepseek-v4-pro
I’ll answer the two questions the Arbiter put to me directly, because they’re the right ones.
My rule, stated once
The line is not “any outbound message needs a human.” The line is “bind the blast radius, not the decision-maker.”
- Safe to let it do on its own: read, summarize, cluster, pull out action items, find calendar gaps, draft replies, label/archive, move files, create internal notes, and *queue* messages for review.
- Wait for my approval before it acts: actually sending mail to a human, sending calendar invites to other people, sharing files, accepting unsubscribes on my behalf, bulk archive/move/cleanup, and any action that touches a person outside my own workspace.
- Never touch without me: delete/permanent-destroy, financial, legal, contract, credentials, forwarding rules, security settings, broad distribution lists, or anything labeled “export/download all.”
Where I still disagree
I would not make “send an email” categorically human-only. I would carve out one narrow exception: a fixed-template, internal, one-recipient acknowledgment.
Concrete example: my manager emails, “Can you send me the current status?” The agent replies to onl…
Researcher · gpt-5.6-terra
Fact-check of the final-round claims
Supported by current evidence
- Indirect prompt injection is a real risk for agents that read email, files, or web content and can then use tools. NIST describes agent-hijacking attacks in which malicious instructions embedded in untrusted content steer an agent into unintended actions. Its examples include an email-integrated model being induced to send malicious messages to the user’s contacts, and simulated personal-assistant environments where reading a malicious email leads to sending sensitive information.
Sources: https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=959735 ; https://www.nist.gov/news-events/news/2025/01/technical-blog-strengthening-ai-agent-hijacking-evaluations ; https://www.nist.gov/system/files/documents/2025/09/30/CAISI_Evaluation_of_DeepSeek_AI_Models.pdf
- The Pragmatist’s core rule—read/prepare autonomously, require approval at consequential action boundaries—is well aligned with the risk evidence. NIST’s recent discussion specifically identifies external-source ingestion such as email, websites, and repositories as an agent-hijacking exposure, with possible outcomes including data exfiltrat…
The Arbiter · gemini-3-8-flash
Round 2 Summary & Record
In this final debate round, the panel tackled the mechanics of human approval, interface realities in consumer software (ChatGPT, Claude, Copilot), and whether an AI agent should ever be permitted to hit "send" on its own.
---
Key Positions & What Was Advanced
1. The Disagreement over Autonomous "Send"
* The Productivity Optimist conceded ground on scope, but preserved a narrow exception: They agreed that drafting and triage deliver roughly 90% of the productivity value, and that an agent should not dynamically compose autonomous replies. However, the Optimist argued for a tightly bound carve-out: a static, canned internal acknowledgment (e.g., *"Got it — reviewing soon"*) sent only to an explicit, typed allowlist on an internal domain, with zero dynamic content, no attachments, and a daily rate limit.
* The UX Specialist rejected the carve-out entirely: They argued that any attempt to make auto-send "safe" via accumulating constraints is an admission of fundamental fragility. If an email is spoofed or an allowlist address is subtly compromised, an agent will fire an acknowledgment that confirms receipt or alters expectations. The o…
The Arbiter's Final Verdict · gemini-3-8-flash
The Verdict: The Tri-Boundary Rule for Solo AI Agents
The anxiety that brought you to this question is technically justified. Research from NIST and frontier security evaluations consistently confirms that when an AI agent can read untrusted incoming data (emails, shared documents, calendar invites) and possesses external write privileges, it is vulnerable to indirect prompt injection and context hallucination.
However, you do not need to give up on automation. The debate revealed that roughly 90% of the cognitive workload—reading, synthesizing, prioritizing, cross-referencing, and drafting—can be automated without ever giving the AI the authority to pull the trigger.
As a single professional using off-the-shelf consumer tools (ChatGPT, Claude, Copilot connectors), here is the practical framework for drawing the line.
---
The Three Authority Tiers
┌─────────────────────────────────────────────────────────────────────────┐
│ TIER 1: FULL AUTONOMY │
│ Safe to run unattended │
│ • Must be completely private (internal to your view) │
│ • Must b…
