Email and calendar access for AI: which permissions to give

A customer emails: "Can we push Thursday to next week?" Answering properly means looking in two places at once: your inbox, to remember what "Thursday" actually was, and your calendar, to see where you have room. Until recently, AI assistants looked at one or the other. What's changed this year is that more and more tools ask to read both in one go, and often to write to them too. This piece is for the small business owner about to click "Allow" (or who suspects someone on the team already has): what you really gain by combining email and calendar, and which permissions to hold back even when the tool asks for them.

Why the pair is worth more than either alone

An assistant that only sees your calendar knows when you're free but not why. One that only sees your email understands the conversation but can't commit to a time. Together they cover the work that actually eats your week, which almost always sits on the border between the two:

• Rescheduling without the back-and-forth. It reads the thread, finds the original appointment, checks your real availability and leaves you a draft with two or three options. You read it and hit send.
• Meeting prep in a minute. Ten minutes before a visit, it summarises your last few emails with that customer: what they asked for, what you promised, what's still open. This is the bit people love most, and the one with the least risk.
• Catching promises that never made it to the calendar. "I'll call you first thing Tuesday", written by you in an email and forgotten. An assistant that sees both can flag that Tuesday has nothing booked.
• Turning confirmations into events. The hotel booking, the accountant's appointment, the supplier delivery all arrive by email; the assistant suggests the event with time and address already filled in.

Notice that in every one of these the value comes from reading and suggesting. None of them needs the assistant to send or move anything on its own.

Permissions, from light to heavy

When you connect a tool to your Google or Microsoft account, the authorisation screen tells you what it will be able to do. It's worth reading slowly, because not every permission weighs the same. From least to most sensitive:

1. See whether you're free or busy. Time blocks only, no titles or details. Enough to suggest slots.
2. Read calendar events. Titles, attendees, notes. Customer information starts here.
3. Read your email. This is where most of your business lives: quotes, invoices, customers' personal details, the password someone sent you once.
4. Create drafts. The assistant writes, but the send button is still yours.
5. Create or move events. Only affects your calendar… until the event has guests, at which point they get notified.
6. Send emails and invitations as you. Whatever goes out carries your name.
7. Delete, archive, create forwarding rules or share your calendar. Changes that are hard to spot and sometimes hard to undo.

For most day-to-day uses, the first four get you most of the benefit. The jump from "draft" to "send" is the one to think twice about.

What I wouldn't give any assistant (yet)

Sending without you seeing it. A badly framed draft costs you a minute to fix. An email to a customer with the wrong date costs you an apology. Until the assistant has weeks of getting it right, let it suggest and you press the button.

Deleting and creating rules. A forwarding rule set up by mistake (or by trickery) can quietly copy your email out for months. No assistant needs that permission to help with your day.

Inviting outsiders. Moving an internal meeting is one thing; sending an invitation to a customer or supplier is speaking for you. Keep it as a draft.

Access to every shared calendar. If your account can see the whole team's diary or the meeting room's, the assistant can too. Ask whether it needs to.

The new risk: emails and invites that give orders

There's a specific reason to be careful with write access. An assistant that reads your inbox also reads what strangers send you, and hidden text in a message or an invite can contain instructions aimed at the assistant. It's called prompt injection.

This isn't hypothetical. In August 2025, researchers at SafeBreach showed that a Google Calendar invitation with instructions hidden in its title could get Gemini to delete events or reveal email content when the user asked something as ordinary as "what's on today?". Google responded by, among other things, adding more confirmations before sensitive actions.

The takeaway for you is simple: the less write access the assistant has, the less harm a malicious message can do. An assistant that only reads and drafts will, at worst, leave you an odd-looking draft.

On your team, everyone has wired it up their own way

This is the part that tends to catch owners off guard. You agonise before connecting anything, while the person who handles bookings gave full inbox access to a browser extension they found three months ago. Not out of carelessness: nobody told them where the line was.

Three things you can do this week:

• Take stock. Both Google and Microsoft let you see, from each account's security settings, which apps have access and with what permissions. If you manage the company accounts, the admin console shows it for the whole team.
• Set one short rule. For example: "Reading and drafting, yes. Sending, deleting and forwarding, no, unless we've talked about it." One sentence everyone remembers beats a ten-page policy.
• Ring-fence the sensitive stuff. If a mailbox receives health information, legal paperwork or payroll, it doesn't get connected to any tool you haven't checked yourself.

When it isn't worth it

Be honest about your volume. If you get fifteen emails a day and four appointments a week, the time saved is small and the risk is the same: you're opening your entire inbox to win back a few minutes.

You also don't need it if your diary is already run by booking software. In a salon or a clinic, customer appointments live in their own system; connecting your personal calendar and inbox as well just adds another door.

And if a tool won't let you choose permissions, or demands everything just to work, that's a good sign to look elsewhere.

The short version

Email and calendar together are one of the most useful combinations you can hand an assistant, as long as it starts by reading and suggesting. Write access is earned over time, and you set the limit, not the authorisation screen. If everyone on your team uses AI their own way and you want a shared standard for what gets connected and what doesn't, that's exactly what we work on in AI for teams.