Which accounts to connect to an AI assistant, and which to skip

Your assistant just offered to connect to your email, and the button is sitting right there. Maybe it also asked about your calendar, your files, your messages or your bank. You want to say yes to the time savings and no to anything that could embarrass you or cost you money.

Which accounts are safe to connect to an AI assistant depends on two things for each account: what the assistant can read, and what it can change or send. Those are separate questions, and each has a setting you can check.

A connection is also not a one-way door. You can look at what is connected in a few minutes and remove what you do not need. Then you can finish with a list of your current connections, one low-risk account to test, and a written rule for what always needs your approval.

Which accounts should I connect first, and which should I skip?

Connect low-risk business accounts first, such as a read-only calendar or a designated project folder. Use a separate business or role account, give the narrowest permission available, and require approval before the assistant sends, publishes, deletes, changes records or moves money. Skip passwords, banking, payroll and administrator accounts unless the exact integration, its permissions and its rollback steps are documented.

That rule comes from the least-privilege advice in OWASP's guidance on excessive agency, which recommends minimum privileges and human approval for high-impact actions. Applied account by account, the rule looks like this.

The verdicts are a starting position, not a permanent ruling. A "not yet" becomes a "yes" after you test the connection on harmless records and confirm it can only do what you intended. A "no" can change when the specific integration documents its permissions, its logging and a way to undo it.

What can an assistant read, and what can it change or send?

Reading and acting are different powers, and each assistant describes them in its own words. A connection can let the assistant look things up, and some connections can also create, edit, delete or send. The authorization screen you see when you connect, along with the app's capability and any workspace controls set by an administrator, decides which of those you are granting. Read each provider's current page before approving, because capabilities vary by connector, plan and account type.

What does ChatGPT let a connected app do?

OpenAI's connected apps page says ChatGPT apps can search connected services and reference files or messages, and for supported apps can create or update information. The permission choices are "Always ask," "Allow read actions," "Allow low-risk actions" and "Allow all actions."

Those settings control when ChatGPT asks you. They do not grant new access, because the data and actions available come from the provider's authorization, the app and your workspace controls. For a first test, "Always ask" or "Allow read actions" keeps you in the loop.

What can a Claude connector do?

Anthropic's page on custom connectors says connectors can retrieve data and take actions such as creating tasks, modifying records or deleting data, depending on the connector. Custom connectors can reach and act in services Anthropic has not verified.

Anthropic recommends using trusted servers, reviewing permissions carefully, limiting the tools you enable and approving tool calls. Treat a connector from an unknown source the way you would treat a stranger asking for a login.

What can Gemini Connected Apps reach?

Google's Gemini Connected Apps page lists Gmail, Drive, Calendar, Contacts, Photos, Wallet and other Google data, which can include emails, files, events, contacts, photos and location-related information. Google says that data may be used for personalization, actions and service improvement.

Because Gemini can reach so many parts of one Google account, a personal account with everything in it is the wrong one to connect. A Workspace role account that holds only what the task needs keeps the reach small.

What can Copilot connectors reach?

Microsoft's page on connecting Copilot to other services says Copilot connectors retrieve files, email, contacts and calendar data using the permissions the account already has. Copilot does not expand access beyond that, so an account that can see everything gives Copilot everything to see.

That is another reason to connect a narrow account. Menus and available connectors differ by Copilot app and by whether the account is personal or managed by an administrator, so check the settings in the Copilot you actually use.

Can a message or document steer an assistant?

Yes, if the assistant has broad permissions, and this is a risk you can act on. OWASP's Top 10 for LLM applications lists prompt injection as LLM01 and sensitive information disclosure as LLM02. Prompt injection means instructions hidden in something the assistant reads, such as an email, a document, a web page or a calendar entry, can change what it does.

The National Institute of Standards and Technology describes the same problem in its January 2025 agent-hijacking evaluation work: malicious instructions inserted into data an agent consumes can cause unintended actions. The assistant does not need to break into anything. It can act within permissions you gave it after reading something it should not have trusted.

So, the practical defense is to limit what a hijacked assistant could do. If it can only read a calendar, a hidden instruction has little to work with. If it can send email, delete files and approve refunds, the same instruction becomes costly.

Approval prompts help, but only if you read them. A prompt you click through without looking gives you the feeling of control and none of the protection.

Will my connected data train the assistant?

It depends on the provider, the plan and the setting, so read the current page before you connect. Training, human review, retention and disconnecting are four separate controls. Turning off training does not remove the assistant's access, and disconnecting does not erase what it already stored.

Google says Gemini Connected Apps data may be human reviewed and used to improve Google services, including training generative AI. Microsoft says connected-service data is not used to train Copilot, though responses that contain that data stay in your conversation history until you delete them.

A business plan's privacy terms are not identical to a personal plan's terms. If you are connecting customer information, find the terms for your exact plan before you approve anything.

How do I see what is connected and disconnect it?

A basic connection audit takes about ten minutes, and you do not need a consultant to click Disconnect. Open the assistant's connected apps or connectors settings and write down every service, account name and workspace. For each connection, record what it can do and whether anyone still needs it.

1. Service and account: Which provider and which login is connected.
2. What it can do: Read, create or write, send or publish, delete, or pay.
3. Approval: Whether the assistant has to ask first.
4. Account type: Personal, shared, administrator or role-based.
5. Connector source: Official, third-party or custom.
6. Still needed: If nobody can name the purpose, disconnect it.

Pay special attention to old connections you forgot about, such as Google, Microsoft, Slack, Drive, Gmail, social, accounting, CRM and password tools. Then check the provider's own list of authorized apps, because disconnecting inside the assistant may not revoke access at the service itself.

These steps come from OpenAI's page on managing app accounts, Google's Gemini help and Anthropic's connector page linked earlier. Copilot menus differ by product and account type, so confirm the path in your own Copilot or with your administrator.

Disconnecting stops future access. It does not delete existing chats, files or memories, so delete anything sensitive from the assistant's history as a second step.

What should I never share with an AI assistant?

Keep passwords, bank logins, payroll records and administrator credentials away from a general assistant. A connection should use the provider's authorization screen rather than a password typed into a chat, and a familiar-looking login page does not make a bank or password connection safe. Before you consider one, confirm the exact integration, its permissions, its audit controls and your business reason for it.

Customer and health information deserves the same caution. Do not paste it into a chat or connect a folder that holds it until you have read the terms for your plan, because retention and review settings vary. A separate folder with only the files the task needs is easier to protect than a whole drive.

If a task needs money to move, treat that as an action that always waits for a person. An assistant can prepare a draft invoice or a list of overdue accounts. A human should approve the payment or the refund.

What if I get the connection wrong?

A wrong setting can be undone, which is why a small first connection is worth the few minutes. The usual problems and their fixes are practical ones, listed here as a checking order rather than a measured ranking.

• Access is broader than needed: Reconnect with a narrower account. Allow 15 to 60 minutes.
• Forgotten connections: Revoke them in the assistant and at the provider. Allow 10 to 30 minutes.
• Send or write access you did not intend: Change the app permissions or turn off action tools. Allow 15 to 60 minutes.
• Approval turned off: Restore "Always ask" or the equivalent, then test one high-impact action. Allow 15 to 45 minutes.
• Sensitive data in chats: Delete those conversations and review the retention setting. Allow 30 minutes, and longer if several people are involved.
• An administrator account was connected: Create a role account with only the rights needed. This can take several hours.

Whoever does this well can name every connected account, say what each can read or change, and say who approves high-impact actions. They write the rule down and test on harmless records first.

When can I do this myself, and when should I bring in help?

You can do the first audit yourself. If you have a single assistant, a few connections and no sensitive customer data, the ten-minute check above covers it, and paying someone to click Disconnect is not needed.

Professional help is worth it when the business has many users, several workspaces, customer or health information, payment systems or custom connectors. It is also worth it when there is no written purpose, scope, owner and rollback path for a connection. If you cannot define those four things for an account, the right answer from any vendor is not to connect it yet.

An adviser can map each connection to a business purpose, replace broad accounts with role-based access, separate read from write authority, set approval rules, test prompt-injection scenarios and build an offboarding routine. If the question reaches your website and the systems around it, a website security audit looks at that wider boundary. For the policy side, our post on an AI use policy for a small business covers what to put in writing.

Frequently Asked Questions About Connecting Accounts to AI

Is it safe to connect Gmail to an AI assistant?

It can be reasonable for a defined business purpose when access is narrow, the account is a role or business account, and sending needs your approval. Start read-only and test on a low-stakes mailbox.

Can an AI assistant send email without asking?

Some connectors support sending, and whether it asks first depends on the permission setting. In ChatGPT, "Always ask" keeps you in the loop. Keep approval on until you have tested the connection.

Should I connect my business bank account?

Treat banking and payment access as high risk. Connect it to a general assistant only when the exact integration, its scope, its monitoring and its approval process are documented.

Can an AI assistant read every file in my Google Drive?

It can generally use what the connected account can reach, so connect an account or folder that holds only what the task needs.

What should I never share with an AI assistant?

Passwords, bank logins, payroll records and administrator credentials. Be careful with customer and health information, and read your plan's terms before sharing any of it.

What happens if I put my email in an AI assistant?

It depends on the provider, the plan and the permission you grant. The assistant can use what the connected account can reach, and Google says Gemini Connected Apps data may be human reviewed and used to improve its services. Read the current terms before you connect.

What This Means for You

The safe accounts to connect are the ones where you know what the connection can read and what it can change or send. A read-only calendar or a single project folder on a business account is a sensible first test. Email, customer records and social accounts stay read-only or draft-only until the connection has proved itself, and banking, passwords and administrator accounts stay out unless the integration and its controls are documented.

A short list of connections, one test account and a written approval rule give you control that does not depend on any assistant's promises. You can add a connection when it earns its place and remove it in minutes when it does not.

If you would like a second set of eyes, Web Leveling can review your connections with you, set the approval rules and tell you which accounts should stay disconnected. Our AI consulting work is built for small and medium businesses, and if a connector touches your wider systems, our team can also look at how AI integrations fit your business before anything goes live. We work with small and medium businesses across the country and overseas. Contact us about reviewing your AI connections, and bring the list.

Terms