What you should never hand an AI agent

An agent is not a person you trust. It is a process that reads text and acts on it.

That distinction matters more than people think, because an agent cannot reliably tell your instructions apart from the content it fetches while carrying them out.

A web page can contain a sentence written in the imperative mood. So can a support ticket, a GitHub issue, a PDF, a calendar invite, an email footer.

None of those are your colleagues.

So here is the rule everything else hangs off:

What you type is an instruction,
everything the agent reads is evidence,
and evidence does not get to issue orders 🔒

I wrote the defensive playbook. Scoping credentials down to one resource, read-only by default, approval gates on anything that leaves the building, keeping keys out of repos and screenshots, and the exact order to do things in when one leaks.

Including the combination that causes actual damage: private data access, plus an outbound channel, plus untrusted input. Any two is fine. All three is a pipe from your data to a stranger.

Free. No email wall.

Comment "SECURE" 👇 and I'll send it to your DMs.