Can an AI agent access files or accounts I haven't given it access to?

The longer version

Here's the distinction that matters. An AI agent is software with credentials, same as any employee login. Give it read access to your inbox and it can read your inbox. Don't give it anything and it can do nothing. The technology doesn't grant itself permissions — but setup screens are designed to make broad access the path of least resistance. "Connect your Google Workspace" sounds harmless until you realize what "connect" meant.

So the real question isn't "can it," it's "what did we hand it, and can we see what it did?" Any agent worth running in a business answers three questions at all times: what can it access, what can it do with that access, and who reviews what it did. If a tool can't show you an activity log of its own actions, it doesn't belong near your business data.

My rule of thumb: start every agent with zero permissions and add them one at a time, each tied to a specific job. An agent that drafts quotes needs read access to the price sheet. It does not need your email, your bank feed, and your entire Drive. Least privilege isn't paranoia — it's just good administration, same as you wouldn't give the new hire the master key on day one.

How BIS handles this

Default-deny is the foundation of everything I build. Every agent I deploy starts with no access and earns each permission explicitly, documented in a boundary sheet you approve. And every agent I build logs what it did, so there's always an answer to "what did it touch while I wasn't watching." If an agent can't explain itself, I don't ship it.