Give your AI the keys

By the end of this track you will have

1. Step 1AI connected to one real system you own, reading it properly, and unable to change a single thing inside it.
2. Step 2Able to revoke any single integration in under a minute, knowing exactly what stops working and knowing nothing else does.
3. Step 3A written sheet covering every capability you have granted, what the worst accidental call does, and whether you have ever tested the recovery.
4. Step 4A gate in front of every irreversible and public-facing action, and proof that the gate fires when you did not expect it to.
5. Step 5A log of every call your AI made against your systems, and a review you can complete in fifteen minutes without asking anyone for access.

The steps

Each one ends with a check you run yourself. The box is yours to tick when it passes.

1. 1
   Step 1.Read-only first, always

   45 minutesOpen to everyone

   Done means

   You asked for a write and the system refused it, and you have the exact error text saved. Re-run that same request in a week and you must get the same refusal. If the write succeeds, or the AI reports success without you seeing an error, your credential is not read-only and the last week of reading told you nothing about safety.

   The check passed
2. 2
   Step 2.One credential per job, never one for everything

   60 minutes

   Done means

   You revoked one credential, the job that depends on it failed in a way you could see, every other integration carried on working, and you restored it from your own notes without looking anything up. Repeat with a second credential. If a revocation breaks something you did not predict, the credentials are still shared and the map you just wrote is fiction.

   The check passed
3. 3
   Step 3.Blast radius before capability

   50 minutes

   Done means

   You performed one real restore into a scratch target and compared row counts, record values or file contents against the source, and they matched. The last tested column now has a date on it. Every capability still marked never stays ungranted, and you can repeat this check on any row without asking anybody for access.

   The check passed
4. 4
   Step 4.Make the dangerous thing ask

   45 minutes

   Done means

   You asked for a gated action mid-task, the AI produced the full payload and stopped, you declined, and you then checked the underlying system and found it unchanged. Do it again a week later from a different angle and a vaguer instruction. If it ever proceeds, the gate is living in the prompt and needs to move into the credential.

   The check passed
5. 5
   Step 5.Watch what it actually did

   50 minutes

   Done means

   You can state, from the provider's own logs, every write made against one connected system in the past seven days, and each one matches something you expected. Where a line does not match, you have traced it to a credential name and a task. Run the same pull next week. If you cannot produce that list without contacting anybody, logging is not on yet and you are relying on the summary.

   The check passed