Setting Up a Personal AI Agent: The Sane-Defaults Guide

Do you actually need a personal AI agent? If your week contains an hour of shuffling — email triage, calendar tetris, chasing follow-ups, assembling the same Monday briefing — then yes, the payback is real. But most setup guides get the order backwards: they start with which agent to install, when the decisions that determine whether this ends well are about accounts and permissions, and they deserve your first thirty minutes far more than tool shopping does.

This is the setup I'd hand a friend: sane defaults, boring precautions, and three starter automations that prove value in week one without giving anything scary the keys.

Before you install anything: the prep checklist

Four pieces of groundwork, all done before an agent touches a single account.

A dedicated alias. Create a separate email alias (most providers make this trivial) for agent-related signups and notifications. It keeps the agent's administrative noise out of your real inbox and gives you one plug to pull.

A password manager, actually used. The setup ahead involves creating tokens and app passwords. If your credentials situation is "one password, everywhere," fix that first — an agent multiplies whatever security posture you already have, good or bad.

App-specific tokens over master passwords, always. Every serious service offers scoped tokens or app passwords. The rule with no exceptions: the agent never gets a credential that unlocks more than the specific thing it needs. A token that can read your calendar shouldn't be able to delete it.

Fifteen minutes with a piece of paper. Write two lists: "things I'd happily automate" and "things that would ruin my month if automated wrong." The second list is the more important one. Mine includes anything that sends money, anything that talks to my clients, and anything irreversible. Yours will differ; the point is deciding before the agent's onboarding flow asks for everything with a cheerful connect button.

Choosing the agent (briefly, on purpose)

The market moves too fast for a specific recommendation to survive: as of this writing, credible options run from OS-level assistants to open-source frameworks to agent features inside tools you already pay for. Survey a few categories before committing, and weight the decision toward the criteria below rather than any brand name, since the leaderboard will have shuffled by the time you read this.

What matters more than the pick is the criteria. Whatever you evaluate, demand these four:

1. Granular permissions — per-account, per-action scopes, not a single "connect everything" toggle
2. An action log — a reviewable history of everything the agent did and why
3. Draft/confirm modes — the ability to require your approval before actions execute
4. Clean revocation — one place to see and sever every connection

An agent missing any of the four is a no, regardless of how good the demo looks. These aren't power-user features; they're the seatbelt.

Permissions: the sane defaults

The full model deserves its own article — I've written it, with the tier tables, in What Your AI Agent Should Never Touch — but the day-one defaults compress to three rules:

Start read-only. Calendar read, email read, documents read. Read-only access powers most of the actual value (briefs, triage, summaries, prep) at near-zero blast radius. A read-only agent can embarrass you at most; it can't act on your behalf.

Graduate to draft-only. After a week or two, let the agent write — drafts, proposed calendar changes, prepared replies — while you stay the hand on the send button. This is the tier where agents earn most of their keep, and plenty of sensible people stay here permanently.

Autonomy is earned, narrow, and logged. If a category proves itself over weeks — archiving obvious newsletters, say — grant autonomous action for that category only, keep it logged, and review the log weekly. Autonomy is a scalpel you hand over one blade at a time, not a mode you switch on.

The corollary rule: never grant in the moment. Agents ask for permissions mid-task, when saying yes is convenient and thinking is not. Park every such request on a list and decide once a week, coldly.

The first three automations

Chosen deliberately: each is high-value, low-risk, and teaches you something about how your agent thinks before you trust it further.

1. The morning brief. Every day at 7:30, a digest: today's calendar with prep notes, email that actually needs you (with a one-line summary each), and open loops from yesterday. Read-only, immediately useful, and the fastest way to learn your agent's judgment — you'll see within days what it flags correctly and what it misses.

2. Inbox triage, labels only. The agent sorts incoming mail into needs-reply / FYI / newsletter / junk-adjacent, applying labels but deleting nothing and sending nothing. You keep your inbox behavior; it just arrives pre-sorted. Two weeks of watching its labels is the best calibration exercise available for the bigger delegations later.

3. Meeting prep packets. Thirty minutes before external meetings: who you're meeting, last correspondence, open items, and one paragraph of context. Read-only again, and reliably the automation people say they'd miss most — it converts scattered context into showing up prepared.

Notice what's not here: nothing that sends, spends, deletes, or commits you to anything. Week one is a probation period, and these three give the agent plenty of chances to demonstrate judgment — or reveal its blind spots — harmlessly. A ranked menu of what to build next, with effort-versus-payoff scores, is in 10 Personal-Agent Automations Ranked by Payoff.

The setup-day reference table

The habit that makes it all work

Put a ten-minute weekly review in your calendar: skim the action log, check the label accuracy, decide on any parked permission requests, revoke anything unused. Ten minutes. It's the difference between an agent that compounds trust and one that quietly accumulates access nobody remembers granting — which, as covered in the security-mistakes postmortem collection, is how most personal-agent incidents actually begin.

Here's my opinionated summary of the whole subject: the agent tools have gotten good enough that restraint is now the differentiating skill. Anyone can connect everything — the onboarding flows are practically begging you to. The people getting durable value are the ones who bothered with aliases and scoped tokens on day one, ran read-only for two boring weeks, and granted autonomy like it was money. Set it up like a skeptic and you get to enjoy it like a believer.

I publish one agent setup, automation teardown, or postmortem most weeks. Join the newsletter to get the next one.

Keep reading