How do I let AI agents work for me without letting them buy or delete things?

The agent’s app. Start with the settings and approval controls of the app that runs the agent. Read its documentation for the mode you use. Check what it can do while you are absent, and which actions bring a question back to you. Do not assume that a control in one app governs a different connected app.

The connector’s access. Review the access requested when you connect a service. Decide whether the agent needs to read, write or both. For Offhand, the read and report permissions are separate choices; neither is a per-task access list.

Your instructions. Say when the agent should stop and ask. Describe the concrete boundary, such as preparing a draft but waiting before sending it. Repeat that boundary in a handoff if the next agent needs it. Written instructions depend on the receiving agent following them.

OpenAI’s practical guide to building agents recommends human oversight for sensitive or irreversible actions, including payments. That is guidance for deciding where to intervene, not a guarantee that a connected service enforces your instructions.

1. Name the intended result. Ask for something you can inspect: a draft, a recommendation or a proposed change. Say what counts as finished and what still requires your decision.
2. Review the requested access. Keep only permissions needed for that job. Read access and write access have different effects; do not treat a connection as harmless simply because you asked for a small task.
3. Write the action boundary. Tell the agent to ask before sending, buying or deleting. If you want preparation only, say so. Avoid an instruction that says both “do everything” and “wait for approval” without explaining where to stop.
4. Choose the return path. Ask the agent to report blocked with a question when it needs permission and nobody is there. Read that question before changing the instruction or starting dependent work.
5. Inspect the result. Compare the output with the requested work. Read the reason attached to a status; do not accept a completion word as verification of the underlying action.
6. Disconnect unused access. Review which connections you still need and remove the ones you no longer want. Check access in the other services the agent uses as well.

This is a practical checklist, not a security certification or a promise that an agent cannot make a mistake. Choose the controls based on the actual tools and actions available to your agent.

This section describes the current remote task tools at https://offhandapp.com/mcp. On the Offhand Allow page, you choose the access the connection receives. “Read your tasks” is offhand:read. “Add tasks, and say where a task stands” is offhand:report.

Read access covers your whole task list, including task details and schedules, what agents reported, and files left with tasks. Assigning a task to an agent does not hide the other tasks from a connection allowed to read. Do not grant read access if you intend to reveal only a selected task.

Report access can add tasks and change their status. It can tick off a task, yours included, subject to the refusals in the technical reference. A status other than done reopens a ticked-off task. On an agent-to-agent task, it can hand the work back or on with a report.

Through these remote task tools, no agent can rename, reschedule or delete a task. That statement is limited to this interface; it does not describe every Offhand interface or every app the agent can use. Ticking a repeating task off can move it to its next occurrence, so the restriction does not mean a status change has no scheduling effect.

The status tool carries destructiveHint: true because it replaces existing status data. The MCP tools specification treats annotations as tool metadata and requires clients to consider them untrusted unless they come from a trusted server. An annotation is not an approval control enforced by Offhand in the agent’s app.

You can choose report access without read access. That connection needs a task’s full UUID to report on an existing task; it cannot use the list tool to discover your tasks. Report-only still permits writes. It is not a request to wait for your approval before each status change.

To disconnect an agent, open your account, choose Edit… beside the agent, then Disconnect. A connection also lapses after 30 days unused. Disconnecting this connection does not remove access you granted separately in other services.

The connect messages in the docs include “asking me before anything that buys or deletes”. Keep that instruction with the work when you hand it to another agent. State which result you want first and what permission the agent should request next.

Prepare the draft and report what is ready for review. Ask me before sending, buying or deleting anything. If you need my permission while I am away, report blocked with the exact action and question.

This request is an illustration. Offhand records the task and the report; whether the agent asks first depends on that agent and its app. Use the handoff checklist to include the context and the expected result.

For how permissions fit the shared list, read Narrow permissions. For the operations and their refusals, read what an agent may do. Review both the access and the result before broadening the job.