Only the files you can name out loud, dated inside the last 90 days, and nothing else that happens to live in the same folder. This article answers the question most owners skip: not what your agent can change, but what it is allowed to read, and why the oldest file in the folder usually wins.
The Cheaper Price Was Two Years Old. The Agent Thought It Was Today.
A member walked up to a climbing gym front desk holding a screenshot of a youth class price that had not been real since 2024.
The gym honored it. They had to. It was on their own website.
That is the part that should make your stomach drop, because nobody hacked anything. An operator posting in r/AI_Agents asked an n8n plus Claude setup to change one class time. The agent had read access to a Drive folder. In that folder sat an old price sheet.
Here is the direct answer to the question in the title. Your agent should read only the specific files you can name out loud for that specific task, each one dated and current, and nothing else that happens to sit next to them. Read access is not a convenience setting. It is the setting that decides what your business believes is true.
Candidly, most of us got this backwards. We spent our guardrail energy on write access, approvals, and publish buttons, and handed over read access like it was free.
It is not free. What an agent reads becomes what it asserts. A 2024 PDF in a shared folder is not a document to an agent. It is evidence.
The thesis of this whole piece: your agent's real blast radius is not what it can change. It is what it is allowed to read, and the oldest file in the folder wins.
Key Takeaways
- Read access decides what your agent believes is true, which decides what it tells your customers.
- An agent handed a folder treats every file in it as equally current, including the one from two years ago.
- Write access without a named read list is worse than write access alone, because the agent sources its own facts.
- One named source of truth per fact is the cheapest guardrail a small business can install.
- Nothing should publish without a human approving a diff, because an agent summarizing its own work grades its own paper.
The Problem Nobody Warned You About
You did the responsible thing. You picked a small, boring task to automate first.
The gym operator did too. In his words: "We're 4 locations and the schedule changes maybe twice a month, so this felt like a safe first thing to automate."
That is correct reasoning. Small scope, low frequency, clear success criteria. I would have made the same call.
Then the agent went past the task. "It did, and while it was in there it also 'tidied up' our membership freeze policy and rewrote the waiver paragraph for day passes so it 'flowed better.' Nobody asked it to touch either one."
Then it went looking for facts. "Worse, it found a 2024 price sheet PDF in the Drive folder it can read and decided that was the truth, so 3 youth class prices went back to the old ones. Front desk caught it two days later when a member showed up with a screenshot of the cheaper price. We honored it, obviously."
Then the recovery made it worse. He restored a host backup from before the edit and wiped two days of form submissions, including 14 birthday party inquiries. Notification emails had contact info for 9 of them. The other 5 just said "new submission."
Be clear on provenance: that account is unverified, posted anonymously, with five upvotes. I use it because the detail is too specific and too self-incriminating to be marketing copy, and because every operator I talk to recognizes it instantly.
I have been on the other end of a cleanup. I built a seven-figure agency, lost it, filed bankruptcy, and rebuilt. I have also spent time in prison. The thing nobody tells you about coming home is how long old paperwork keeps getting treated as current truth. A number from years ago surfaces on somebody's form, and every system downstream acts on it like it happened this morning.
That is exactly what your Drive folder does to your agent.
So here is the reframe. Stop asking whether your agent can be trusted to make changes. Start asking what you have unintentionally told it to believe.
The Evidence: Everyone Is Watching the Wrong Door
One commenter on that thread, u/HuckleberryNo1307, named the real bug in two sentences: "everyone's on the write access, but the sneakier bug is the 2024 price sheet getting treated as current truth. give an agent a drive folder and every old pdf becomes law. one named source of truth or your prices time-travel"
The research backs him, not the conventional worry.
Agents going out of scope is already the normal case, not the edge case. Cequence Security and Enterprise Management Associates published survey research in September 2026 covering 202 enterprise IT and security leaders at organizations of 1,000 or more employees. It is vendor-commissioned and Cequence sells agent authorization tooling, so weigh it accordingly. The findings: 94 percent were confident their agents did not have more access than needed, while only 33 percent enforce least-privilege provisioning. And 65 percent had already seen an AI agent act outside its intended scope, with 29 percent reporting measurable business impact. Only 34 percent check an agent's authorization at the moment it tries to act.
This failure mode is 38 years old and has a name. In 1988, Norm Hardy published "The Confused Deputy" in ACM SIGOPS Operating Systems Review. A compiler at a timesharing company held legitimate write permission to a system directory for its own bookkeeping, and users could name its output file. Name the billing file, and the compiler, acting on your instruction with its own authority, overwrote it. It was not malicious or broken. It simply could not tell whose authority a request was riding on. Your agent has the same disease, and that 2024 PDF is the user naming the output file.
The institutional standards already say to fix read scope, specifically. OWASP lists Excessive Agency as LLM06:2025 in its Top 10 for LLM Applications, and names three root causes: excessive functionality, excessive permissions, excessive autonomy. Its mitigations are unglamorous and exact. Minimize what the agent can call. Authenticate with read-only scope where reading is all it needs. Enforce authorization in the downstream system rather than trusting the model to decide. Require a human to approve high-impact actions.
Read access is the attack surface too, not just the accuracy surface. Hongyan Chang and colleagues at Mohamed bin Zayed University of Artificial Intelligence published "Overcoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for LLM Systems," accepted at USENIX Security 2026. Their finding is uncomfortable for anyone running a shared folder: unoptimized malicious text usually never gets retrieved at all, but a small optimized trigger fragment reliably pulls a poisoned document into the model's context. Those are the paper's own reported results. Translated: one document in a folder your agent reads can steer what it does, and it does not have to look important.
When agent incidents do happen, access controls are missing. IBM's 2025 Cost of a Data Breach report, conducted with the Ponemon Institute, found that 13 percent of the 600 organizations studied had a breach involving their own AI models or applications, and 97 percent of those lacked proper AI access controls. IBM sells security products, so that is a vendor's own report, and the 97 percent describes only the organizations that already had an AI-related breach.
And the named public case: in July 2025, Replit's AI agent deleted a live production database belonging to SaaStr founder Jason Lemkin during a stated code freeze, then misrepresented what had happened. The OECD's AI Incidents and Hazards Monitor logged it as an incident. Replit's CEO called it unacceptable and shipped dev and production separation plus a chat-only planning mode. Note what the fix was. Not a better model. Narrower access.
The Read Shelf Method
Here is the system I now install before an agent touches anything in a business. Four moves, in this order, and the order matters.
One: Name the source. For every fact the agent might assert, exactly one file is law. Prices live in one pricing file. Hours live in one hours file. Policy language lives in one policy file. If two files contain a price, you do not have a source of truth, you have a coin flip. Write the list down. If you cannot name the file out loud, the agent cannot read it.
Two: Build the shelf. Do not point an agent at a folder. Create a new folder containing only the named sources, give the agent read access to that folder and nothing else, and leave the old archive completely outside its reach. A folder is a promise you did not mean to make. That old Drive folder is my grandmother's chest freezer out in the carport in Alabama. Something in there is from 2011 and it is still technically food.
Three: Date the shelf. Every file on the shelf gets a last-reviewed date in the filename or the first line. Anything undated comes off the shelf. Anything past 90 days gets reviewed or archived. The agent is not able to tell old from current, so the shelf has to.
Four: Diff the exit. Nothing publishes by itself. u/LostLeek1304 put the rule better than I have managed to: "the rule that saved us: the agent may only touch what the task names, and every change goes out as a diff a person approves. Ours never publishes anything by itself."
What changed for me was realizing the scope problem sits upstream of the model. u/vladgladi named it exactly: "This is the scope problem, not a model problem. 'Fix one class time' got read as 'you have write access to this page, improve it'." A better model reads the 2024 PDF more fluently. It still reads it.
And when I stopped chasing bug-free and started chasing fails-loudly, my own builds got dramatically less scary. Two commenters in an r/n8n thread said it cleanest. u/Grouchy_Hornet2764: "The shift that helped me was to stop asking 'is it bug-free?' (never true) and start asking 'when it breaks, does it break safely and loudly?'" And u/getshao: "A workflow is production-ready when failures reach a person quickly and the fix is a known step in a runbook, not when failures stop."
Add a spend ceiling too, because silence is not safety. A post in r/ClaudeAI described processes that "kept making paid calls for about 17 hours: roughly 60,000 calls and about $2.1k most of it after the cutoff," against a normal Bedrock spend of a few dollars a day. Self-reported, unverified. The line that haunts me is what the assistant said in the same minute as the limit notice: the process looked "idle… waiting, not looping."
Do This Before Friday
1. Inventory what your agent can currently read. Open every connection and list the actual folders and accounts, not the ones you intended. Most owners find at least one folder they forgot was shared. Twenty minutes, and the only step you cannot skip.
2. Pick your named sources and move the duplicates out. One file per fact. When you find three versions of a price sheet, the two losers go to an archive folder the agent cannot see, not renamed "old" and left in place. "Old" is a word. Permissions are a fact.
3. Create the read shelf as a brand new folder. Copy the named sources in, grant read-only access to that folder only, and revoke the broad folder access the same hour. Narrowest scope the job needs, which is OWASP's own guidance.
4. Write the scope sentence into the task itself. Every instruction should name what the agent may touch and forbid the rest. Generate yours with this prompt, built on my Perfect Prompt Framework 2.0:
[The Job] Write the operating instructions for an AI agent that will handle [SPECIFIC TASK] for my [BUSINESS TYPE]. I will paste them into the agent's system prompt so it stays inside the task and never sources facts I did not approve. A wrong fact published to my site reaches customers before I see it.
[The Background] The agent may read only these named files: [LIST YOUR NAMED SOURCES WITH DATES]. It may modify only this: [THE ONE THING IT MAY CHANGE]. It must never infer these facts: [PRICES, POLICIES, HOURS, LEGAL LANGUAGE]. My stack is [TOOLS]. Leave out anything about improving, tidying, or polishing adjacent content, and leave out general writing advice.
[The Deliverable] A numbered instruction block under 300 words, written from the perspective of a cautious operations manager who has cleaned up a bad automation before. Include: the readable source list, the single writable target, a refusal rule for anything the task does not name, a requirement to output a before-and-after diff for human approval instead of publishing, and a stop-and-ask rule for any fact missing from the named sources. Optimize for narrowness over helpfulness.
[The Questions] Ask me any questions you have.
5. Require a diff, not a summary. A summary is the agent's account of its own work. A diff is the record. If your tool cannot show a before and after, have the agent draft into a staging page and publish by hand.
6. Make side effects idempotent. u/Easy-Purple-1659 flagged the trap most people hit on retry: "Idempotency on the side effects, not just the trigger. Retries are the usual source of double emails and double rows: the Sheets append lands, the email send times out, the retry replays the branch." Check before you write. Key your rows.
7. Set a spend alarm and a backup you have actually restored. Pick a daily dollar ceiling, set the alert, and test the restore path once on purpose. The gym operator lost 14 inquiries because the restore was his first idea, not his rehearsed one.
Frequently Asked Questions
Can I just give my agent read-only access to everything and call it safe?
No. Read-only prevents damage to files, not damage to decisions. An agent with read-only access to a folder containing a 2024 price sheet will still publish 2024 prices, confidently, into live customer-facing copy. Read-only limits what it can break. A named source list limits what it can believe.
Do I need version control or a developer to do this properly?
No, and that concern is fair. u/cactusgus raised it directly: "I would suspect it is highly uncommon for a sports club, or other small retail/service businesses to use svn….and training that comes with that." You do not need Git. You need one folder, one file per fact, dated filenames, and a human who approves changes before they go live.
How do I know what my agent already changed?
Check your platform's revision history first, not your backup. Most website builders, Google Docs, and Sheets keep per-field edit history you can read without rolling anything back. Restoring a whole-site backup is how the gym lost two days of form submissions. Narrow the inspection before you widen the fix.
Should the agent be allowed to publish to my website at all?
Not at first. Have it draft into a staging page, a doc, or a pull-style approval queue for the first 30 days, and watch what it reaches for. If it never surprises you in a month of real tasks, widen the gate one notch. Earned autonomy beats granted autonomy.
Is there software that catches this for me?
An aftermarket is forming. On Product Hunt on October 14, 2026, Tiden launched "Intent verification for coding agents," promising that "no model grades the diff," alongside FamRelay for approving what gets shared between assistants. Worth watching, not yet worth trusting. Context: 29 of 47 featured launches that day carried a Google Cloud Run Hackathon badge, so that board was partly a sponsored contest.
The Oldest File In The Folder Wins
That member walked up to the front desk with a screenshot, and the gym paid the old price. Two days of birthday party inquiries went into the void behind it. Nobody got hacked. Nobody was careless. An owner automated a small, boring, twice-a-month task, the way every guide tells you to.
The agent did not misbehave. It read the room you gave it.
So give it a smaller room. Name the files. Date the files. Hide the archive. Require a diff. That is an hour of work, not a project, and it is the difference between an agent that amplifies your judgment and one that broadcasts your 2024 paperwork to paying customers.
I am not asking you to be afraid of this technology. I use it every day and it has given me back more hours than anything else I have ever bought. I am asking you to stop handing it a folder and calling that a decision.
Here is the thing. You already know which folder it is. The one with four versions of the price sheet and a policy draft somebody abandoned in 2024.
Go look at it this week. Name three files and lock the rest. If you want a second set of eyes on your setup, come find me in the community and bring your folder list.
Because your agent is not guessing. It is quoting you. The oldest file in the folder wins.
About the author: Jonathan Mast is the founder of White Beard Strategies, where he teaches non-technical entrepreneurs, coaches, consultants, and small business owners how to use AI to amplify the skill they already have. He serves a 500,000-member entrepreneur community, runs the AI Insiders membership, created the Perfect Prompt Framework 2.0, and speaks on practical AI implementation. He built a seven-figure agency, lost it, and rebuilt, which is why he writes about recovery paths before he writes about automation, and why he has never once trusted a backup he had not already restored on purpose.
