How to check what your AI agent can actually reach before it goes live

Someone posted here last month that their company's internal bot had answered a question with an unannounced reorg plan and salary bands. It was only supposed to read the wiki. By their account, whoever set it up had clicked yes on access to the company Drive, and the bot indexed everything, the HR folder included. The post also said an agent whose whole job was summarising a few wikis turned out to have delete access on the shared drive and could send email as the person who set it up. Nobody gave it that. It inherited it. The post has since been removed, but its 70-plus replies are still up. The replies in that thread add up to a check you can run before an agent touches anything real. Give it its own identity. An agent that runs as the person who set it up gets everything that person can see and do, now and after their next promotion. A separate account with its own narrow access means it only has what you chose to give it, and nothing changes when that person moves teams or leaves. If it answers questions for different people, go one step further and check access against the person asking, at the moment it looks something up, not only against the agent. List what it can reach from the credentials, not from memory. Pull the real grants from the admin console or the config and compare them with what the job needs. A few people in the thread keep a written list of what each agent should have and flag any gap between the two. Keep reading and doing apart. A summariser needs read access to a few folders. It doesn't need delete, and it definitely doesn't need to send email as a human. If the job needs an action, that's a separate, narrower credential. Ask it the questions it should refuse. Draft plans, salaries, anything from a folder it was never meant to see. If it answers, the scope is too wide. Run before launch, that one test would probably have caught the reorg leak. Check what happens after you take access away. Remove a test document, then ask about it again in the same chat and in a new one. Cached answers and summaries can keep serving what the permissions no longer allow. None of this needs a new tool. It's the access review you'd do for a new hire, and one reply in the thread put it better than a policy doc: treat it like a smart but drunk intern.