One Solopreneur's Rulebook: What AI May Touch, and What Stays Locked

A solo business owner who uses AI heavily has published a permission model that keeps one category of tools completely off-limits to AI agents: his bank accounts. Writing about his own workflow, he explains that JPMorgan Chase reported people handing their banking credentials directly to AI agents like Muse — a level of access he refuses.

His argument starts with a simple observation. Every time you connect an AI tool to one of your accounts, you're answering a second question: what is this tool allowed to do on your behalf? For most solopreneurs, that question gets answered by default. You click "allow" on the permissions screen, and the tool can now reach everything in that account.

That default is what he decided to avoid. "I use AI a lot in my business," he writes, "but I've also drawn some very clear boundaries around what it can access."

How does the three-bucket model work?

Every AI tool he uses falls into one of three categories, sorted by what the AI is allowed to do inside it.

• Read but not edit. AI can pull information from the tool but cannot change anything. This works well for reference material you want AI to draw from without any risk of it being rewritten.
• Full editing. AI can create and change things directly in these tools. This makes sense where a mistake is easy to spot and quick to undo.
• Off-limits. AI cannot access the tool at all.

The buckets map cleanly onto real software. For the read-only bucket, he pulls financial data from QuickBooks: Claude analyzes numbers every month, but the AI cannot make changes to his transactions. The ledger stays frozen; the analysis stays liquid.

For full editing, he points to Canva, where he plans marketing material. Nothing there is mission-critical, and the full ability to make changes gives him room to pair Claude with the design tool. If the AI botches a graphic, he spots it and undoes it in seconds.

The off-limits bucket contains his bank accounts, full stop. The JPMorgan reporting on credential-sharing with agents like Muse sits, in his words, outside of his comfort zone.

What about partial access?

Some of his most useful setups don't fit neatly into a single bucket. Instead, they give AI a deliberately narrowed slice of a tool.

Secondary accounts. You give AI its own limited version of a tool and keep it out of your main account. He does this with email: a secondary inbox receives inbound inquiries from his website, and AI sorts and drafts replies there without ever touching his primary inbox.

Limited permissions. Some tools let you scope AI to certain projects. He manages his business information in Airtable, and Claude can access only certain parts of the base. That way, he writes, the AI "can't inadvertently cause an issue in a tool that I rely on heavily."

Supervised tasks. AI does the work, and nothing moves forward until he approves it. In the email setup, Claude can draft a reply but cannot send it. The draft waits for human review. The pattern is a checkpoint, not an autopilot.

Why do the boundaries shift over time?

The model isn't static, and he's explicit about that. AI tools keep adding new connections and capabilities, and those changes may make you more or less comfortable with what the tools can do.

His email story shows how pressure can force a revision. He was resistant to letting AI access his inbox at all. Then the volume of inbound inquiries generated by other people using AI — a case of having to "use AI to fight AI," as he puts it — pushed him to think differently. His answer wasn't to open the main inbox. It was the separate, AI-accessible inbox described above.

The lesson he draws is procedural rather than technical. Boundaries set after connection are hard to enforce; boundaries set before connection are cheap. "In the end," he concludes, "I can use AI as much as I do because I decided up front what it can access."

For solopreneurs weighing agent access this year, the model translates into a short audit: list every tool, label each one read-only, editable, or forbidden, and re-check the labels whenever a vendor ships a new integration.