Scoped connector access: why read and send are separate permissions

The fastest way to lose trust in an AI agent is to give it more access than the task needs. An agent that summarizes your inbox does not need the ability to send mail from it. An agent that drafts replies for review does not need to publish them unsupervised.

Every connector in Cortez AI — Gmail, Google Drive, Notion, Slack — is modeled as two separate permissions: read and send. You choose which an agent gets, per agent, not once for your whole workspace. A research agent might get Drive read-only. A support agent might get Gmail read and send, scoped to a single label.

This isn't a compliance checkbox we bolted on afterward — it's the reason connectors are modeled as a pluggable app in the first place, so adding a new provider later never means retrofitting permissions onto something that was never designed to have them.