Letting an AI agent read your email is one permission. Letting it send is another

You are about to connect your email, calendar or messages to an AI agent that keeps working after you close the app. OpenAI’s dots, Grok Bot and Meta’s Muse are three such agents. [1] [2] [3] Their official pages are reassuring: OpenAI calls the tools a dot uses for background research “read-only”, Grok Bot has “Ask first” rules, and Meta’s small-business announcement for Muse says “You’re in control”. [4] [5] [6]

Each phrase means something narrower in the product’s own documentation. Three points from those pages, as they read on 30 September 2026:

• Reading and acting are separate permissions. Meta says that for email, people choose “whether it reads their mail or can also send on their behalf”. [3]
• “Read-only” describes what the tools can change in your apps. It leaves open what the agent keeps. OpenAI’s read-only research still saves “private notes”, and a dot can “form memories” from connected information. [7] [1]
• An approval is not an undo. The Grok Bot documentation says: “An approval controls the proposed action. It does not reverse work already completed.” [5]

What the official pages say

Each of the three works on a computer in the cloud. [1] [8] [3] Each cell below is what that product’s pages say. The designs differ, so this is not a ranking.

What “read-only” leaves out

OpenAI’s help page says a dot can review connected information proactively “and form memories from it, even when you haven’t asked a new question.” [1] Disconnecting an app later “does not delete information your dot has already obtained from it.” [1]

In Muse, reading can go ahead without a prompt. Meta’s safety post says: “Read-only, previously allowed, or demonstrably low-risk actions can proceed without interruption.” [17] After you disconnect a connector, the data Muse used from it “may remain in Muse’s memories and your conversation history.” [13]

In Grok Bot, saving to memory sits outside the automated check. The security page says of Auto Review: “It does not review every side effect. Memory writes and most settings changes are examples.” [20]

Our reading of these pages: an agent limited to reading can still build its own record of what it read. “Read-only” tells you whether it can change your apps; row 2 is about what it remembers.

What an approval does not do

Approving lets a proposed action run, and stopping ends work that is still going. Neither is an undo. In the Grok Bot docs, a “Stop now” message ends work immediately but “does not undo actions the Bot already completed.” [22] OpenAI’s FAQ says: “You can ask your dot to help correct a mistake, but some actions cannot be undone.” [9] Meta’s help page gives an example: “Some other actions, like sending an email, cannot be reversed”. [18]

An approval can also last longer than the moment you gave it. In Grok Bot, choosing Always allow “can save a matching rule”. [5] In Muse, “Always allow” means it “can take this type of action for this Connector in the future without asking again”. [18] OpenAI’s FAQ says that for dots, “Approving one message does not give your dot ongoing permission to contact people on your behalf”, and that any advance approval “remains limited to what you authorized.” [9]

What the pages say about mistakes

OpenAI and Meta both say outright that their agents can make mistakes. OpenAI’s help page: “Your dot can make mistakes, including when following your rules.” [1] Meta’s: “Your Muse can make mistakes or take unexpected actions.” It adds: “You’re responsible for fixing errors, including with third party services or recipients.” [18]

The Grok Bot pages we read do not use the word “mistake”. They do warn that a Bot can work from out-of-date information: “Memory is not a substitute for an authoritative source”, and one instruction is to “Correct stale assumptions directly”. [14] Of the automatic check they say: “Auto Review is model-based and should complement, not replace, least privilege and explicit approval boundaries.” [5]

Eight things to decide before you switch on background work

Row numbers refer to the table.

1. Which accounts it may read (rows 1 and 2). Check what is already connected. OpenAI says plugin permissions “are shared across dots, ChatGPT, ChatGPT Work, and Codex”, and Meta says Facebook, Instagram and Threads “are connected automatically if you have your accounts in the same Accounts Center.” [9] [23]
2. Whether reading may become memory you cannot open (row 2). Find out where notes and memories are kept, whether you can read and edit them, and what remains after you disconnect a source.
3. Which actions must always ask (rows 3 and 5). The Grok Bot docs give a sample rule: “Ask first before sending any external email.” [5]
4. What you will pre-approve, and for how long (row 4). Our suggestion: take the narrowest grant on offer, such as once or for one task.
5. What you check before approving a send (row 3). OpenAI suggests being specific about “who it should go to, what it should say, and when or under what conditions it should be sent.” [9] See what to check before an AI sends your message.
6. Whether the automatic check can be switched off, and by whom (row 6).
7. Whether it can reach your own computer (row 7). On a Mac that can involve Full Disk Access, which Meta’s help page says “covers all the files on your Mac”. [21]
8. How you stop it (row 8). Find the pause or stop control before you need it.

Where Kluro sits

Kluro publishes this article and makes a Mac app in the same broad area; it overlaps with these agents on the reading side. It searches the conversations in the sources you have connected and brings back the relevant exchange, which you can open to check. Kluro’s pages describe finding, remembering and preparing; they do not describe Kluro sending messages or acting in other apps for you. Row 2 applies to it too: saved memory stays encrypted on your Mac, and enabled hosted AI processes relevant content for answers and background understanding (privacy), so not everything happens on the device. None of the three agents is among the sources Kluro connects to.

How we checked

We read the products’ public announcements, help pages, documentation and policies on 30 September 2026. We did not install, operate or test dots, Grok Bot or Muse, and ran no comparison, so this article cannot tell you how they behave. “Not documented in the pages we read” means only that. Settings screens behind a login were not seen.

Official pages disagree in two places. OpenAI’s safety post says some actions “require your confirmation each time”, while its help FAQ says such actions “may require approval each time”. [7] [9] Meta’s small-business page says “Nothing publishes, sends or spends without your approval, and you can undo it”, while its help page says sending an email cannot be reversed. [24] [18] Help pages change without notice, so reread the current wording before you connect an account.