# The Agent Access Ladder (free file, kitwisestudio.com/free/agent-ladder)
Kitwise Studio. A template for deciding what an AI agent (Claude, ChatGPT, Gemini or any other) may touch. Opinion plus sources, checked Oct 24, 2026. Not security or legal advice.

## Why a ladder
- OpenAI, Oct 23, 2026: "we believe the responsible approach is to conduct frontier model training with no internet access." It now trains in an "offline world" of cached web content. (This is about models in training, not the ChatGPT you use.)
- Claude Help Center: prompt injection works when an agent can both read content outside your trusted sources and take actions that could hurt you. Remove one of the two and attacks get harder.
- Anthropic, Claude Duet (Oct 21, 2026): even with your approval it will not trade securities or move money between accounts, and it asks before it sends a message, makes a payment, signs a document or deletes anything.
The idea: give access one rung at a time, and only climb when the rung below has been boring for a while.

## The 4 rungs
Rung 1. Read only, your own stuff.
Agent can read files you hand it in one folder. No browser, no connected inbox. Good for: summaries, drafts, checklists.

Rung 2. Read your accounts, write nothing.
Connect inbox, calendar or drive as read access where the tool allows it. Agent drafts; you send. Good for: inbox triage, meeting prep.

Rung 3. Write, with approval on every send, pay, delete or publish.
Manual approval for anything that leaves your computer or cannot be undone. Good for: calendar invites, file cleanup in a test folder.

Rung 4. Run alone on low-stakes jobs.
Auto or scheduled runs only for jobs where the worst case is a bad draft. Review each run.

## Never on any rung (our rule, in line with the sources above)
- [ ] Bank, payroll, tax or payment accounts
- [ ] Your logins to client accounts (their CMS, ads, hosting, inboxes)
- [ ] Password manager vault or 2FA codes
- [ ] Sending to clients without you reading it first
- [ ] Health or other sensitive personal portals

## Fill-in template (one line per tool)
| Tool | Rung today | What it can read | What it can do | Needs my OK for | Review date |
|---|---|---|---|---|---|
| | | | | | |

## Weekly 5-minute check
- [ ] Any connector or plugin I no longer use? Remove it.
- [ ] Any scheduled task I forgot? Pause it.
- [ ] Did the agent touch a file, site or person I did not mention? Drop it one rung.

## Sources (all opened Oct 24, 2026)
- OpenAI, Securing our frontier model training environment, Oct 23, 2026: https://openai.com/index/securing-our-frontier-model-training-environment/
- TechCrunch, Tim Fernholz, Oct 23, 2026: https://techcrunch.com/2026/10/23/openai-says-it-will-no-longer-train-its-ai-models-on-the-live-internet-citing-significant-risks/
- The Verge, Emma Roth, Oct 23, 2026: https://www.theverge.com/ai-artificial-intelligence/1018021/openai-training-top-ai-models-no-internet
- Claude Help Center, Use Claude Cowork safely: https://support.claude.com/en/articles/13364135-use-claude-cowork-safely
- Anthropic, Introducing Claude Duet (announced Oct 21, 2026): https://claude.com/resources/articles/claude-duet