Connect an assistant to your mailbox and the narrowest permission that lets it read one message lets it read every message. Connect it to your drive and the default search corpus is, in the publisher's own words, files owned by or shared to you. There is no supported way to say my files, except the folder the legal team shared with me. The unit of restriction is the application. It is never the data.
This is a dated edition of a page that changes. The Lab holds our current thinking, and current thinking moves. This PDF does not: it is what we thought on the date stamped below, kept so the reasoning can be followed rather than only its conclusion. The live page may since have been corrected, extended or withdrawn — and if it has, the edition list on it will say so.
Connect an assistant to your mailbox and the narrowest permission that lets it read one message lets it read every message. Connect it to your drive and the default search corpus is, in the publisher's own words, files owned by or shared to you. There is no supported way to say my files, except the folder the legal team shared with me. The unit of restriction is the application. It is never the data.
Each of these was read on 12 September 2026 from the linked page, and quoted rather than paraphrased. Nothing below required an account, a test or a request to anybody's system.
“View your email messages and settings.” The description ofgmail.readonly— the narrowest Gmail scope that returns a message body. The only scope that excludes bodies isgmail.metadata, described as “view your email message metadata such as labels and headers, but not the email body”, and it cannot read a message. There is no scope that filters by sender, label or date. · developers.google.com — Gmail API scopes
“Files owned by or shared to the user.” Google's definition of theusercorpus — andcorporadefaults touser. So on day one, the default search over a Drive grant spans everything any colleague, client or counterparty has ever shared with that person, without anybody choosing it. · developers.google.com — Drive files.list
“Site-specific permissioning (using*.Selectedpermissions) is not supported because the underlying search is tenant-wide.” Anthropic's security guide for its own Microsoft 365 connector, describing why the narrowing mechanism Microsoft provides cannot be used. The same page states that shared-mailbox access is read-only viaMail.Read.Shared, and that the connector uses delegated permissions so a user reaches only data they already have permission for. · support.claude.com — Microsoft 365 connector security guide
account_info.read·files.metadata.read·files.content.read·files.content.write·sharing.read·sharing.write·file_requests.read·file_requests.writeThe eight scopes requested by the official Dropbox MCP server. Two of them are write scopes and two are sharing scopes. There is no folder-scoped variant. · help.dropbox.com — connect the Dropbox MCP server
The unit of restriction is the application and the tool. It is never the data.
Every lever these products offer turns a capability on or off for an assistant. None of them narrows which material that capability reaches. That is the finding, and it is why a behaviour policy for a connector shape is a different document from one for a coding agent: the question stops being how far can it reach and becomes whose material is in reach.
This is the objection a vendor would raise first, it is correct, and stating it makes the finding stronger rather than weaker.
These are not accusations. Marketing copy and scope lists are written by different people at every company on earth and nothing reconciles them. It is, however, precisely the condition a behaviour policy exists to surface — so this table is the product's value in one figure.
| What is advertised | What the scopes in the grant permit | State |
|---|---|---|
| Share, move and trash files | The grant's two file scopes are a read-only scope and a per-file scope. Neither authorises acting on a pre-existing file the assistant did not create | unresolved |
| Create, update and delete calendar events | The publisher's own scope list for that service, as granted, is read-only | unresolved |
| Label and unlabel mail threads | Neither scope in the published grant authorises label mutation. A gmail.labels scope exists and does permit it — it is not in the grant | unresolved |
| Search files | Whether the shared-drive parameters are set is undocumented, so whether team drives are in the corpus in practice cannot be determined from the pages | undocumented |
These stay unresolved, on purpose.
Each could be settled in an afternoon by connecting an assistant and trying it. We will not: probing somebody else's system to find out what it does is out of bounds here, with no research exemption. An unresolved contradiction, sourced to both of a vendor's own pages and dated, is worth more than a resolved one obtained by poking. If a vendor tells us which page is right, this table changes and says so.
Sources for the table, all read 12 September 2026: Gmail scopes · Drive scope classifications · shared-drive parameters · the official server's scope list · and the connector descriptions those scope lists sit behind.
The published capability grammar gives every primitive a reach — project, host, tenant, world, self — and an undo class. Neither says anything about who the material belongs to, and for a connector shape that is the only interesting question.
read.record.mailbox would say the agent can read a mailbox. It would not say that the mailbox contains correspondence from clients who never agreed to any of this.| Proposed property | Values | Meaning |
|---|---|---|
| material | own organisation third_party mixed | Whose material the capability reaches |
Almost every connector capability is mixed, and that is the finding.
A mailbox is mixed. A shared drive is mixed. A personal notes folder is own. The value of the property is that mixed cannot be made own by any setting any of these vendors offers — which is the user-shaped finding expressed as data rather than as a paragraph, and therefore computable.
This is a proposal against somebody else's published data, not a change we can make. It is written up as a request, with its evidence, at Lab 03.
A mailbox is mostly other people's writing. A shared folder is mostly other people's files. So a connector grant is, by construction, a grant over material that was entrusted rather than owned — and that is a provision, not an analogy.
The regulator's assessment: ICO Tech Futures — agentic AI, 8 January 2026. Read 12 September 2026. This page states the law's text and its dates; it is not legal advice and nobody here is your lawyer.
Real questions, published so nobody has to rediscover them. If you know the answer to one of these, that is the most useful thing you could send us.
material belong in the shared capability data or in the policy? It is a property of a capability in a context, which argues for the policy. It is reusable across every policy of the same shape, which argues for the data.This page holds current thinking, and it will change. Each edition below is a dated, immutable copy of what it said on the day, with its own digest. Nothing is rewritten; the list only grows.
Digests for every edition are in lab-editions.json, so a PDF somebody was sent can be checked against this list.
Five deployment shapes, each one a document that makes the sentence above visible for a setup somebody actually runs. The flow that produces them — and what buying one would look like — is drawn next door.