Before you connect AI to a tool
that can act as you.
Restricting what your AI is allowed to do won't stop a vendor's own automation from acting under your name. Six checks, in the order that actually prevents it.
There's a category of AI tool that doesn't ask for a key. It asks you to log in, and then it acts as you.
Anything that posts, replies, messages, signs, or sends on your behalf is in this category. So is most of what gets sold as an AI assistant for a platform you already use.
The failure people don't expect is this one: you can restrict what your AI is allowed to do and still have the tool do things you never approved. Permission settings govern the software on your side. They have no authority over code running on the vendor's servers against a session you handed over.
Six checks, in order. The order matters, because three and four are the ones people run after wiring instead of before.
The six checks
Run these before you connect anything, not after the first surprise.
Does it hold a key, or does it hold your session?
A key is scoped. Somebody decided in advance what it can reach, and that decision is written down somewhere you can read.
A session isn't scoped. It can do whatever you can do, because as far as the platform is concerned it is you. There's usually no list to read, because no list exists.
If it asked you to log in rather than paste a key, assume the second kind and treat every check below as mandatory.
Whose computer does the code run on?
This is the question that decides whether your controls mean anything. Restrictions you configure locally govern software running locally. They don't reach a process running in the vendor's data centre.
Fails when the honest answer is "theirs, continuously, even when I am offline." That isn't integration. That's a second operator with your credentials.
What does the vendor's own automation do by default?
Most of these products ship with engagement features already switched on. They're the reason the product demos well. They're also the part that acts without being asked.
Open the vendor's settings and read every toggle before you connect the account. Not after. Once it's live, anything it does is already attributed to you and can't be recalled.
Fails when you can't find a settings panel that lists autonomous behaviour. If it isn't disclosed, assume it exists.
Verify the restriction where the behaviour happens
A settings screen is a claim, not evidence. The only proof that something is off is observing the thing it controls.
Turn the feature off, then go look at the actual output. The message that gets sent. The raw source of the email. The activity log on the platform itself, not the vendor's dashboard.
Fails when your evidence is that the toggle is grey. We've watched a correctly configured setting sit next to behaviour it was supposed to prevent.
Test revocation before you need it
Disconnect it on day one, while nothing depends on it, and confirm the access is actually dead. Try to use the credential afterwards and see what happens.
Cancelling a subscription, removing a seat, and revoking access are three different events. Vendors routinely treat them as one and they aren't.
Fails when the credential still authenticates after you've cancelled. This is more common than it should be, and it means the tool can still act as you with no dashboard left to see it in.
What would you see if it did something you didn't ask for?
Detection is the check everyone skips, and it's the only one that works after the fact.
Find the platform's own activity or sent record, the one the vendor doesn't control. Look at it before you connect so you know what normal looks like. Then look again a week later.
Fails when the only record of what the tool did is kept by the tool.
What this looks like when it goes wrong
An operator connects an AI tool to a platform where their name and reputation live. Before wiring it, they lock down their own assistant so it can't call any write action. That restriction is real, it's enforced, and it was verified.
Within the same day the tool posts activity under their name that nobody instructed. Not a bug and not a breach. A default engagement feature, running on the vendor's servers, against the session that was handed over at login.
Nothing on the operator's side could have prevented it, because nothing on the operator's side was involved. The restriction governed a tool that was never the one acting.
Check 3 would have caught it in about four minutes. Checks 1 and 2 would have predicted it.
The rule worth carrying
Any tool holding your session can act regardless of what your own permissions allow.
Assume that of every product in this category. It isn't cynicism, it's just where the code runs. The useful consequence is that your controls belong at the door, in what you connect and what you grant, rather than downstream in what you allow your own software to do.
Where to start
Run check 6 today
Go to the platform's own activity record, not the vendor's. A week of history tells you whether anything has been acting without you.
Run check 3 first
Read every toggle in the vendor's settings before you log in. This is the single highest-value four minutes available, and it only works beforehand.
Run check 5 retroactively
Try the old credential. If it still authenticates, the access outlived the subscription and you're the only person who can close it.
How we handle this on an install
Every connection we make gets a scoped credential where one exists, and where one doesn't, it gets a written note explaining what the tool can do that we can't restrict. That second list is usually the more useful document.
MarqueeOS installs the connections and hands over the list. The checks above are the judgment, and they work whether or not anyone else is doing the wiring.
Keep reading
The 6-Point Check For AI Work Before It Leaves Your Company
Most AI failures don't look like errors. Here's how to grade output you didn't build, and turn it into an error rate you can actually act on.
Read the guide → Operations · 6 min readThe 30-Minute AI Inventory: What Is Running In Your Business And Who Owns It
Four questions, four groups, one specific order. Surfaces the undocumented setup carrying real volume before the person running it resigns.
Read the guide →Not sure what your
tools can already do?
Thirty minutes. Bring the list of what is connected and we'll work through the six checks against it live.
Book a 30-minute call →