Credential boundaries for a personal AI agent that reads mail, calendar and a browser: delegated versus shared identity, read/write/irreversible scope, resumable re-auth, secrets kept out of the transcript, an audit log a non-engineer can read, and six checks before you hand over an account.
Who holds the key: credential boundaries for an AI agent that reads your mail, calendar and browser
