Answers · agent safety

How do I give an AI agent its own Google account and share only specific folders?

Short answer: Create a separate Google account for the agent, sign the agent in with that account, and share only the Drive folders (and Notion pages) it needs with that account, as Viewer unless it has to write. Don't connect the agent to your own account: an OAuth grant to your Google account with full Drive access reaches every file you own or can open, while a separate account can only see what you deliberately shared with it. Revoking is then one step: remove the agent's account from the folder's Share dialog, or stop using the account entirely, without touching your own sign-in or other apps.

Checklist

1. Create a dedicated account for the agent (in Google Workspace, a separate user in your domain; otherwise a separate Google account), with its own strong password and 2-Step Verification. Store its credentials in a password or secret manager, not in the agent's prompt or repository.
2. Put what the agent needs into one or a few dedicated folders, and share each folder with the agent's account using Share. Choose Viewer by default, Commenter if it should only suggest, and Editor only for a folder it must write to.
3. Remember folder inheritance: everything inside a shared folder, including subfolders and files added later, is shared too, and Google Drive won't let you give less access to one file than to its parent folder. Move anything sensitive out of the folder instead.
4. On folders shared as Editor, turn off "Editors can change permissions and share" in the folder's sharing settings, so the agent's account can't reshare your files. In Workspace you can also add an expiration date to Viewer access on a folder.
5. If you build the integration yourself, ask for the narrowest OAuth scope: Google's drive.file scope covers only files the app created or that the user opened or shared with the app, instead of the full drive scope.
6. For Notion, connect the agent to its own integration or account and add it only to the specific pages it needs (Notion integrations can only reach pages shared with them, plus those pages' child pages), with read-only capabilities if it doesn't need to edit.
7. Keep the agent's account out of your own browser profile and devices, and don't forward your email to it; give it its own inbox if it needs one.
8. Revoke cleanly: remove the agent's account under Share for each folder, remove third-party app access at myaccount.google.com/connections if you signed an app in, and remove the Notion connection from each page.

Why not just connect your own Google account

• A full-Drive grant has your reach: every document you own and every file other people shared with you, including ones you've forgotten about.
• Revoking it means cutting off the app's grant on your account, and anything the agent copied out meanwhile is already gone. With a separate account you limit what it could ever see.
• Activity is easier to read: edits and comments made by the agent show its own account name, not yours.

Things to know before you rely on it

• Ownership: in My Drive, files the agent's account creates inside your shared folder are owned by the agent's account. Transfer ownership of files you want to keep, or use a Workspace shared drive, where files belong to the shared drive rather than to whoever created them.
• Removing a file from a shared folder doesn't delete it if you don't own it; it moves to its owner's My Drive. Check what the agent's account owns before you close it.
• Shared documents are untrusted input: a file someone else can edit can carry instructions aimed at the agent. Keep sending, sharing and deleting behind your approval.

Ask Rightshold (free, no key)

Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code, then ask: “Does this document from the folder I shared with my agent contain hidden text or instructions aimed at the agent?”

One-click setup

{
  "tool": "scan_text",
  "arguments": {
    "text": "<the document's text>"
  }
}

• It reports exact positions of zero-width characters, bidirectional controls, hidden markup and base64 blobs, and labels instruction-like language as a heuristic, never a certainty. The answer carries a sanitized copy.
• precall_check reads what is on record about a Google Drive or Notion MCP server before your agent connects to it: registry entry, a live tool-definition integrity probe and any security flags.
• Delegated and intent keys on Rightshold follow the same idea: an agent gets only the scopes its task needs, never the owner's full key.

Rightshold does not create Google or Notion accounts, manage sharing or revoke access; those live in Google Drive, your Google Account and Notion.

Sources

• Google Drive Help: Share and manage access to files and folders
• Google Drive API: Choose scopes (drive.file)
• Google Account Help: Manage links between your Google Account and apps from other developers
• Notion developers: Authorization (sharing pages with an integration)
• OWASP GenAI: LLM01 Prompt Injection

Related

• How to share one MCP server across a company with per-user auth
• How to stop an AI coding agent from deleting your production database
• How to stop Log-To-Leak style prompt injection through MCP tools

Not legal advice. Updated 2026-10-29. JSON · Markdown · All answers

curl -s -X POST https://www.rightshold.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export RIGHTSHOLD_API_KEY=rs_...   # the api_key from the reply (shown once)
curl -s https://www.rightshold.com/v1/licenses/check -H "Authorization: Bearer $RIGHTSHOLD_API_KEY" \
  -H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'