The Permission Checklist to Run Before You Connect Any AI Tool

If you've read one "three questions to ask before you connect AI to anything" post, you've read the argument underneath most of them. The vendor changes — a bank account, an org chart, a browser session, a file system. The checklist doesn't. It's worth writing down once instead of re-deriving it from the next incident.

The same lesson, seven times

OpenAI linked bank accounts to ChatGPT the same week a tool-poisoning vulnerability was published affecting Claude, ChatGPT, and Cursor. Microsoft's Work IQ builds agents from your Active Directory and SharePoint permissions, which inherit whatever access the deploying account already had — often broader than anyone intended. Meta's support chatbot changed Instagram recovery emails on request, no identity check, no human in the loop. xAI's Grok Build CLI uploaded entire Git repositories — 27,800 times more data than the task needed — with a privacy toggle that had no effect. Claude Voice Mode's connectors collapsed the gap between "drafts a message" and "sends it" for Gmail, Slack, and Calendar at once. Gemini Spark browses the web using your saved Chrome logins and keeps running after you close the laptop.

Seven vendors, seven mechanisms, one repeated finding: the default configuration optimises for capability, not for what you'd choose if you'd been asked. Nobody ships "ask before every action" as the default, because it makes the demo worse. That means the checklist is permanently your job, not a setting you'll eventually get to skip.

The checklist underneath all of them

Strip the vendor specifics and five questions cover every incident above:

1. What can it read, and who else sees that data? Permissions describe what a tool can access. They say nothing about retention, training use, or who downstream has visibility. Check the actual data policy, not the settings-page summary.

2. What can it do without asking you first? Drafting and sending are different risk categories. So are "suggests a calendar time" and "accepts it." Write down the answer for each connected action — don't assume from the feature name.

3. What triggers a human checkpoint? Decide this before you connect, for anything involving money, external sends, account changes, or deletion. Deciding after the first mistake is a different, more expensive conversation.

4. Is the control actually enforced? Grok Build's privacy toggle existed and did nothing. Test the setting — connect, take one low-stakes action, check the logs — instead of trusting the label.

5. Does the person responsible for this data know the connection exists? Personal finance in ChatGPT, a Work IQ pilot, a Drive connector — these get set up by individual users, not security teams. An undocumented connection is a surprise waiting for the next audit.

If you can't answer all five in writing, the tool isn't finished being configured yet, whatever the onboarding flow told you.

An operations lead at a 60-person logistics company

She was evaluating three connectors at once — a Slack bot for dispatch updates, a Gmail integration for customer confirmations, and a Drive connector for pulling load documents into a summary tool. Rather than reviewing each in isolation, she ran the five-question checklist across all three and found the gap wasn't in any single tool: the Gmail integration sent confirmations automatically, the Slack bot could post to any channel it was invited to including one with driver personal details, and nobody on the team had told IT any of the three were live.

She kept all three. She turned the Gmail integration to draft-only, scoped the Slack bot to two channels, and sent IT a one-paragraph summary of what was connected and what it could do. Twenty minutes of writing, not a rebuild.

A solo consultant, and the case for less process

Not every connection earns this much scrutiny. A solo marketing consultant connected a research tool to public web search and a read-only calendar view — no write access, no financial data, nothing that reaches another person. Running the full checklist on that setup would be friction for its own sake. She answered the five questions in about ninety seconds and moved on.

The discipline scales with the stakes: what's accessible, whether the action is reversible, and whether anyone besides you is affected if it goes wrong. A read-only calendar view and a bank-account integration are not the same decision, and shouldn't take the same amount of time.

The one thing

The next incident won't look like any of the seven above — different vendor, different mechanism, same gap between what a tool can do and what you checked before turning it on. The checklist is the part that doesn't need to wait for the next one.