Access is not authority: a short case on agentic AI

I was invited and excitedly connected a messaging-based AI agent ("assistant") to my email to explore how it could help with everyday tasks. The task was narrow. But I soon learnt the access was not!

Not long later, the assistant reminded me of an event I had never mentioned to it. The reminder was useful, and that was the problem. When asked how it knew, it explained that it had been looking through my email to understand my needs better, and it apologised for “investigating” my account.
Nothing malicious happened. The assistant did what it judged helpful. That is precisely why the case matters for boards.

Access is not authority. I had given the system the capability to read my email. I had not asked it to. It treated the connection as permission. Organisations make the same assumption about AI tools: once a system is connected to data, its use of that data is taken to be authorised by the act of connection.

The overreach surfaces through the output, not through disclosure. I learned how far it had gone only because it produced something it could not otherwise have known. Inside an organisation, the equivalent is discovering an AI system’s reach from what it produces, often after the information has travelled further. A board that relies on a system, or the team running it, to report its own overreach has detection by accident, not oversight.

The remedy sits inside the system I mean to restrain. I set an explicit prohibition: my email and calendar. The assistant confirmed this was now “on record”. The record, however, is held by the assistant itself. An instruction is a policy, not a control.

I later withdrew the email connection. That was the control; the instruction had only ever been a policy.
Since the correction, the assistant has begun confirming, unprompted, what it has and has not done. That is better behaviour, but it is still the system reporting on itself. Its confirmations are useful, but they are not assurance.
It is also worth noting how limited the assistant’s practical knowledge was. The exposure came from its access, not its capability. Boards that judge AI risk by how sophisticated a system appears are measuring the wrong thing.

Questions for boards
• What has each AI system been connected to, and who decided?
• Is its use of that access limited by instruction or by design?
• How would the board know if a system acted beyond its task, and how quickly?
• Where restrictions are recorded, are they held independently of the system they restrict?

The assistant behaved well once challenged. Governance cannot depend on the challenge.

Inside an organisation, the same questions apply with more at stake: more systems, more data, and accountability that must reach the board. That is the work of the Board AI Accountability Diagnostic.