Is it safe to let an AI agent use your accounts?
It can be, if the agent gets only the access its task needs, every write it can make is visible before it runs, and you can stop it at any time. The risks come from broad permissions, tools that write when you expected a read, and credentials kept carelessly. Here is a checklist that works for any agent, and how Ditto AI handles each point.
What can go wrong
Most agent mistakes aren’t dramatic. They’re ordinary errors made quickly, in places that matter:
- A write you didn’t expect: an email sent instead of drafted, a row overwritten instead of added.
- Access wider than the task: an agent that only needed one folder can read the whole drive.
- A check that changes things: a tool “tested” by actually sending a message.
- Instructions hidden in content: an email or web page with text written to steer the model.
- Credentials in the wrong place: a key pasted into a prompt, a note or a shared file.
- No way to stop: a run that keeps going, or leaves processes behind after you close it.
Five rules for giving an agent access
1. Give it only the tools the task uses
If the task reads email and writes one spreadsheet, the agent should hold a mail tool and a sheet tool, and nothing else. Every extra tool is something that can go wrong.
2. Know which tools read and which write
Reading is recoverable; writing often isn’t. Every tool should be marked as read or write, and anything you can’t classify should be treated as a write.
3. Review before the first run
You should be able to read what the agent will do, step by step, with the tools and access for each, before it does any of it.
4. Draft before sending
For anything that leaves your hands, such as a message, a payment or a shared file, have the agent prepare a draft you approve, at least until you trust it.
5. Be able to stop it, completely
Stopping a run should stop everything it started, and you should be able to see what it did up to that point.
How Ditto AI applies these rules
Ditto AI builds agents from a recording of you doing a task, so it knows exactly which tools the task used. That makes these rules concrete:
| Rule | What Ditto does |
|---|---|
| Only the tools it needs | The agent may use only the tools your recording actually used |
| Reads vs writes | Access comes from a fixed table, not from the model. Public web pages are read-only. A tool Ditto can’t classify is treated as a write |
| Checks that don’t change anything | Each tool is verified with one real, read-only call. Nothing that writes is ever exercised during a check |
| Review before running | You see the process, every step with the frames it came from, every tool with its status, and the reason each was chosen |
| Draft before sending | With Ask before it creates, sends or changes anything on, every write is prepared as a draft and shown to you first |
| Stop completely | Stop ends the run and every tool server it started |
Even with the ask option off, an agent does only the writes you recorded, in the same place, and still stops to ask before deleting anything, sending somewhere new, or doing anything you didn’t record.
Where your data and keys go
- Recordings stay on your Mac, in Ditto’s own folder under Application Support, readable only by your user account.
- Speech is transcribed on the Mac, or not at all. There’s no server fallback.
- The model that reads a recording is the one you choose at setup: your own Anthropic, OpenAI or Amazon Bedrock account, or Ditto AI’s. It receives the frames, clicks and transcript it needs to understand the task.
- Your provider keys and Ditto token are stored in the macOS Keychain. Tool credentials stay in Ditto’s private folder on your Mac.
- Installing a tool server that needs Node or uv shows you the exact command, with Allow and Deny, before anything is installed.
Questions to ask any agent tool
Before you connect an agent to real accounts, whatever it’s built with, get a clear answer to each of these:
- Which tools will it have, and which of them can write?
- Who decides its permissions: the model, or a rule you can read?
- How does it check that a tool works? Could the check itself change something?
- Can I see every step before it runs, and every action after?
- Can it ask me before it sends, deletes or pays?
- Where are my keys stored, and who can read them?
- What exactly stops when I press Stop?
If a tool can’t answer these, keep it away from accounts that matter until it can.
Start small
The safest way to hand work to an agent is the same as with a new colleague: start with a task where mistakes are cheap, watch the first few runs, and widen what it can do as it earns it. How to build an AI agent without writing code has a checklist for picking that first task.