Why your inbox is not a security guard
We are told that keeping an AI assistant safe is simple: before it spends your money or sends your file, it will ask for your approval. But if the assistant can read your email, who is really answering?
Imagine walking into a bank branch to arrange a large wire transfer. You hand the teller your withdrawal slip. The teller looks at the amount, stamps it, walks around to the manager's side of the desk, stamps it with the manager's approval seal, and hands you the receipt.
You would not call that oversight. You would call it an illusion.
Yet that is how most automated assistants handle permission today. Software makers reassure us that their tools are safe because they keep a "human in the loop." Whenever an assistant prepares to take a high-stakes step, it pauses to ask for your confirmation.
In theory, that sounds responsible. In daily practice, that safeguard often collapses into one of two common traps.
Two ways software permissions break down
The first trap is the prompt avalanche. Picture asking an assistant to plan a family weekend trip. To check your schedule, it asks for permission to open your calendar. To check tickets, it asks to open your browser. To verify a reservation, it asks to access your messages.
Within fifteen minutes, your screen fills with a dozen permission boxes. Nobody reads twelve legal popups while cooking dinner. You simply click allow all to make the interruptions stop. Security researchers call this permission fatigue. It turns genuine oversight into a thoughtless reflex.
The second trap is subtler and far more dangerous: the false sentry. To spare you from constant popups, systems often rely on confirmation passcodes. When the assistant tries to finalize a booking or pay a bill, the service emails a one-time code to your inbox.
Now consider what happens when that same assistant has permission to read your email to help with your schedule. When the confirmation passcode arrives, the assistant does not need to wake you. It simply reads the code from your inbox, pastes it into the form, and approves its own transaction.
This is not a hypothetical bug. Security researchers recently proved that software agents can read their own approval emails and bypass human confirmation gates entirely.1, 2 When the sentry and the worker share the same mailbox, there is no real guard at all.
The day pass and the separate buzzer
Fixing this does not require giving up on helpful assistants. It requires two straightforward habits that we already take for granted in everyday life: the day pass and the separate buzzer.
1. The day pass (task-scoped permissions). When a contractor visits your office to repair an air conditioner, you do not hand them the master keys to every filing cabinet in the building. You give them a visitor badge that opens the utility closet and expires at five o'clock.
An assistant should work the same way. If you ask it to find receipts from last month, it should receive permission to read only messages matching that request, and that permission should expire the moment the search ends. Bounding permissions to the task at hand prevents an assistant from rummaging through unrelated files.3 We explore how bounded keys replace master passwords in AI agents should hold permissions that expire.
2. The separate buzzer (out-of-band approval). When an errand reaches a consequential fork (spending money, changing account settings, or sharing confidential notes) the question must travel over a road the assistant cannot reach.
Rather than popping up a window inside the browser where the software is working, the request should ping a physically separate device. A simple tap on your phone's fingerprint sensor or a dedicated confirmation screen proves that an actual person made the call. It creates a checkable record, similar to the signed action envelopes we discuss in Who is actually acting?.
Three moments where a second key matters
To see how these two habits protect you, consider three everyday moments where software assistants are taking over tasks.
Gathering receipts at tax time. You ask an assistant to collect receipts for your yearly tax filing. With broad permissions, a confused or hijacked assistant could scan your entire inbox, reading personal family letters and sensitive health notices. With a task-scoped day pass, the assistant can touch only emails marked as invoices, and its access shuts down when the tax summary is done.
Rescheduling travel during a delay. A winter storm cancels your flight, and your travel assistant scrambles to book an alternate route. The airline system offers a seat with a steep rebooking fee. If the assistant can read its own confirmation emails, it might accept the costly fee without checking with you. With a separate buzzer, your phone vibrates with a clean one-sentence question before any payment clears.
Paying a supplier invoice. If you run a small bakery and use an automated tool to reorder flour, a pricing glitch from the mill could trigger an order for double your normal volume. Because consequential payments require a second key, the assistant cannot finalize the transfer on its own. You review the unusual price on your handheld screen and reject the charge with a single tap.
What this means
You stay in control without spending your day clicking through permission boxes. The assistant handles the routine work, and you hold the only key that can authorize irreversible acts.
What a separate key cannot do
We should also be clear about the limits of this protection. A separate buzzer ensures that an assistant cannot secretly approve its own actions. It does not guarantee that the flight you approved was the best choice, or that the supplier will deliver on time.
Human oversight still requires human attention at critical milestones. The goal is not to eliminate thinking, but to make sure your attention is asked for only when it truly counts.
Where this leaves you
As AI assistants take on longer errands, the promise of saving time is real. But convenience without boundaries is simply an accident waiting to happen.
Before you let an assistant manage your errands, ask two simple questions: Does its permission expire when the task ends? And does approval happen on a separate device that the assistant cannot touch?
If the answer to either question is no, the system is asking you to trust an assistant to check its own homework. Insisting on a day pass and a separate buzzer is how we make sure technology serves us, rather than the other way around.
1. Jinhao Zhu, Kevin Tseng, Gil Vernik, Xiao Huang, Shishir G. Patil, Vivian Fang, and Raluca Ada Popa, MiniScope: Authorizing Agents with Least-Privilege Permissions, arXiv:2512.11147 (December 2025).
2. Samuel Breckenridge, Dani Vilardell, Wenhao Wang, Fan Zhang, and Ari Juels, I-HITL: Inalienable Human-in-the-Loop, arXiv:2610.35835 (October 2026).
3. Jack B. Dennis and Earl C. Van Horn, Programming Semantics for Multiprogrammed Computations, Communications of the ACM, 9(3), 143–155 (March 1966).
