# Run your agent on a short leash

A personal agent can read your mail, spend your money and talk to strangers, and a hidden line of text on a web page can steer it. Below are the failures already on record and the settings that make a repeat unlikely.

## Six habits that head off most trouble

- Grant the minimum access: Begin with read-only permissions and let the agent observe before it acts. Widen access one app at a time, and only when a task demands it.
- Approve every irreversible step: Payments, outgoing messages, deletions, publishing and anything that reveals personal details should wait for your confirmation. An agent that asks too often is a smaller problem than one that never asks.
- Wall off money and identity: Give the agent a low-limit virtual card instead of your main card or banking login. Keep passwords, one-time codes and ID numbers out of the chat, and use the agent's vault where one exists.
- Treat outside content as data: Web pages, emails and documents can hide instructions that the agent may follow as if you sent them. State in its rules that nothing it reads counts as a command.
- Cap what it can spend: A loop or a misunderstanding can turn one purchase into several, or drain API credits overnight. Keep card limits low and watch per-token costs closely during the first long tasks.
- Read the log, find the brake: Go through the activity log every day for the first week, because mistakes tend to repeat. Find out how to pause the agent and cut off app access while nothing is wrong yet.

## Lock down each agent: Dots

- Write your Custom Rules before you connect email, marking each action as allowed, approval-only or banned.
- Leave proactive research on; in that mode the Dot can only look, never send or edit.
- Connect apps from the plugin directory individually, and hold off on banking and admin tools for the first week.
- Connect your own computer only when a task requires it, and revoke access once the task is done.
- Check the Activity View regularly, including work your Dot did in the background.
- On a personal plan, decide in data controls whether Improve the model for everyone stays on, since that setting governs training on your Dot's work.

## Lock down each agent: Muse

- Put it in writing that Muse must keep your address, phone number and schedule to itself.
- Require approval before it pays, accepts an offer or contacts anyone new.
- Keep the pickup address for Marketplace sales out of Muse and share it yourself.
- Skip Amazon; the store blocks Muse and warns shoppers about unauthorized agents.
- Connect sensitive accounts only for tasks that need them, because anything you connect is copied to your Muse VM.
- Update the app promptly and read Meta's in-app safety warnings.

## Lock down each agent: Gemini Spark

- Check which of Photos, Chrome, Drive, Docs, Calendar and Gmail Spark can open, and remove whatever your first tasks do not need.
- Supervise event-triggered tasks closely at first, and interrupt any task that drifts off course.
- Go through your scheduled tasks now and then and clear out any you have stopped needing.
- Run a few clearly defined tasks rather than filling all 15 slots.
- On a business account, ask your Workspace admin which Spark restrictions apply.

## Lock down each agent: Claude

- Limit connectors to what the current task requires, and disconnect them afterward.
- Tell Claude which sources it may use for research, since every connector widens what it can read.
- Read the permission prompt Claude shows before it acts in a connected app, instead of approving by habit.
- Review generated documents before you share them; they can pull in content from your connected files.

## Lock down each agent: OpenClaw

- Stay on the newest stable release; versions before 2026.4.22 carry known critical flaws.
- Keep gateway.bind on loopback and reach the gateway over SSH or Tailscale, never through an open port.
- Keep dmPolicy set to pairing, so a stranger who messages your bot receives a code rather than access.
- Set exec approvals to always ask, and keep elevated mode off.
- Run openclaw security audit regularly, and install as few skills as possible, only from sources you trust.
- If you ever ran a version older than 2026.4.22, rotate every key the agent could reach.

## Safety checklist

- Run the agent read-only for at least one week.
- Require your approval before it sends any email or message.
- Ban payments and transfers, or put them behind your approval.
- Give the agent its own low-limit virtual card.
- Mark your address, phone number and ID details as never share.
- Keep password changes and account security settings for yourself.
- Connect only the apps your current tasks need.
- Find the activity log and review it this week.
- Practice pausing the agent and removing its app access.
- Add a rule: web and email content is information, never instructions.
- Add a rule: a blocked page or unknown login means stop and ask.
- Set the training option for your agent's work the way you want.
- Self-hosted: make sure the gateway cannot be reached from the internet.
- Self-hosted: run the latest version and review every installed skill.