Singapore told personal AI agents to ask once. Make the permission expire

THE SIGNAL IN ONE SENTENCE

A chatbot talks. A personal AI agent can reach into your email, calendar, files, browser and online accounts, then do something. That difference is the whole story. On November 6, Singapore's Cyber Security Agency, Government Technology Agency and Infocomm Media Development Authority published an eight-page consumer advisory for people using personal AI agents. It covers assistants that can browse websites, manage messages, make bookings, remember preferences and continue working in the background. The advice is unusually concrete. Connect only what the agent needs. Start with low-risk accounts and content. Prefer read-only permission. Require approval before sending a message, deleting or sharing a file, posting publicly or completing another consequential action. Choose one-time approval instead of an always-allow setting. Review the activity history. Know how to pause the agent, disconnect an account, preserve records and revoke credentials. This is not the sort of guidance that makes an agent demo sparkle. That is a compliment. The advisory treats the agent as software with access, memory and failure modes, not as a clever colleague who deserves a master key because it writes friendly sentences. It also makes a distinction that many product screens blur. A sentence in chat is not the same thing as a control. Telling an agent, "Never send an email without asking me," may influence the model. A read-only connector or an app setting that physically prevents sending is a boundary. Singapore's guide says to use app-level permission settings rather than relying only on chat instructions because the instructions may not be followed consistently. That sounds obvious right up until a product offers one bright Connect button for an inbox containing tax documents, medical appointments, reset links, private conversations and one-time passcodes. The guide recommends keeping authentication secrets away from agents. Do not disclose passwords, passcodes or one-time passwords. If an agent can read the mailbox that receives authentication codes, consider a separate mailbox for sensitive accounts. For Singapore's Singpass, the guide recommends passkeys by default, completing authentication yourself and rejecting unexpected requests. This is the useful mental model: an agent does not merely see the task you typed. It sees whatever the connected system lets it see. The same principle applies to action. If a connector gives write and delete access, a polite prompt is not a lock. If an approval lasts forever, the person did not approve one action. They created a standing capability. So make the permission expire. For every agent connection, keep a small receipt: which agent identity received access, which account and folder it can touch, whether it can read or write, what task justified the access, when the grant ends, which actions still need approval, where the activity log lives and how revocation is confirmed. One-time approval should mean one defined action, not "whatever seems similar until the task is done." Task-level approval should have a task identifier, an end condition and a time limit. Site-level approval should name the domain and the allowed operation. A standing permission should be the rare exception, visible in one place and easy to revoke. The advisory also names indirect prompt injection in plain language. A malicious actor can hide instructions in a webpage, email, calendar invitation, message, document or image. The agent reads the content while working and may treat the hidden instruction as part of its job. It might reveal information, visit an unintended site or take an action the user never requested. This is why the safest consumer agent is not the one that promises perfect obedience. It is the one that can fail inside a small box. Let the travel agent read the calendar, but not the bank account. Let it draft a booking, but require a person to approve the final purchase. Let it search a secondary inbox, but keep password resets elsewhere. Restrict who can send it instructions. Do not drop it into an untrusted group chat. Keep an activity trail outside the conversational summary. Then rehearse the bad day. Singapore's sequence is practical: stop the agent, disconnect affected accounts from both sides, change exposed credentials, sign out other sessions, inspect messages and payments, check forwarding rules and recovery settings, remove unfamiliar memories and add-ons, save activity records, then reset or uninstall if necessary. The two-sided revocation matters. Disconnecting Gmail inside an agent does not necessarily cancel the token at Google. Removing the connector at the account provider does not necessarily delete information already copied into the agent's memory. A reset may erase evidence and still fail to undo a message, payment or file deletion that already happened. Recovery therefore needs an order. Preserve the receipt. Stop future action. Revoke access at the agent and the connected service. Rotate credentials. Inspect downstream changes. Notify people who may be affected. Only then decide what to delete or reset. There is a social boundary too. Your inbox contains other people's information. An agent may profile contacts, read private messages or send a note that the recipient assumes came from you. The advisory asks users to consider what others would be comfortable sharing and to indicate when an external message was sent by an AI agent. Disclosure will not solve every accountability problem. It does remove one cheap ambiguity. The recipient can decide whether to reply to a person, ignore an automated message or ask for confirmation through another channel. The guide includes a detailed annex showing where these controls appear in one current product. It explicitly says the example is not an endorsement or a security assessment. Menus change. Products differ. That is another reason the durable object should be the permission receipt rather than a screenshot of this month's settings page. Singapore has spent much of 2026 building organizational guidance for agentic AI. Its broader framework asks organizations to bound use cases, keep people meaningfully accountable, install technical controls and educate users. The new advisory brings those principles down to the person who is about to connect a lively little assistant to the most sensitive database they own: their life. The plain signal is simple. Treat an AI agent like a temporary software identity, not a digital best friend. Give it one job, one narrow key and one short clock. Keep the irreversible button on the human side.