Short-Lived AI Access Checklist

Sometimes a connection is worth it for one job: questions about your health records, taxes, finances or legal documents. If you decide a connection is necessary, limit its scope and duration, supervise it, and verify cleanup afterward. This reduces risk. It doesn't erase it.

Each of us is in charge of our own risk appetite. If even a short connection feels like too much, use the Cautious path instead: download only the documents you need, remove identifiers, and use a temporary chat with nothing connected.

Before you connect

• ☐ Write your questions first. Batch them so the connection is open as briefly as possible.
• ☐ Consider a download instead. Many portals let you download specific records. Choosing three documents beats granting access to everything.
• ☐ Turn off training and memory before connecting, not after. Otherwise memory may capture details during the session.
• ☐ Keep everything else off. No email, calendar, web search or browsing in the same session. Some tools use memory to shape web searches, so turn both off. Sensitive data, untrusted content and a way out is the combination to avoid.
• ☐ If the connection you need is email itself, clean it out first. Empty spam and junk, and delete old unsolicited or suspicious messages. Phishing you ignored can still be read by an artificial intelligence (AI) tool. This shrinks the risk; new messages keep arriving.
• ☐ Narrow the scope where offered: specific records, a date range, read-only.
• ☐ Consider a separate AI account used only for this, with nothing else connected and its own passkey.
• ☐ Ask family members before including their information.
• ☐ Know how you'll revoke access, both in the AI tool and at the source account.

During the session

• ☐ Ask only your prepared questions.
• ☐ Know how to pull the plug. Find the Stop control and the place to remove access before you start.
• ☐ Don't let it act. No sending, sharing or creating anything.
• ☐ Save the answers you need, then end the session.

After you're done

• ☐ Save the output carefully. Use encrypted storage outside folders that sync online, and set a date to review or delete it. You've created an organized summary of sensitive information; protect it like the original.
• ☐ Revoke at the source, not just in the AI tool: your Google or Microsoft connected-apps page, your patient portal or other account's app authorizations. Then confirm it's gone.
• ☐ Delete in order: share links, generated files, project files, saved memories, then the chats. Reopen settings to confirm memory is empty.
• ☐ Request deletion from any intermediary service the connection used, following its privacy policy.
• ☐ Watch for unusual activity. Check sign-in alerts and, where available, the source account's access history.
• ☐ Verify important answers with a qualified professional, such as your clinician or tax preparer.

What risk remains

Changing a setting or disconnecting doesn't necessarily erase data already received. Check each service's retention and deletion rules. A checked box records a decision, not a guarantee of safety.

CC BY 4.0. Provided as is, without warranty.

---

The author develops commercial security tools in this area. These resources are tool-neutral and recommend no product. Product names, when used, are examples rather than endorsements. Own IT, Secure IT, and Protect IT draw on the 2019 Cybersecurity Awareness Month theme; Monitor IT extends the cycle into a repeatable personal habit. General educational information, not a scan, compliance assessment, or guarantee of safety. CC BY 4.0.

Explore the guides

All AI safety guides | Reference library