Free tool

Security & trust-zone checklist

Half the score is what the vendor documents. The other half is how you set it up. Pick an agent, then tick what you’ll actually do.

Agent

What the vendor documents

•Does each agent get its own isolated computer?—

•Is the agent kept from seeing your raw passwords and card numbers?—

•Can you view and delete individual memories?—

•Does it ask before sensitive actions (send, buy, delete)?—

•Are prompt-injection defences documented, with a public bug bounty?—

•Is there an audit trail and admin governance?—

Your setup

I’ll start the agent on a secondary inbox or label, not my whole primary mailbox+3Connectors start read-only; I add write access one app at a time+3Payments go through a capped wallet or virtual card, never my main card+3Every connected account has 2FA, and I know how to revoke the agent’s session+2I’ve written down which accounts are Green (agent can act), Amber (ask first) and Red (never)+2I’ll review the agent’s activity log weekly for the first month+2I won’t let it act on instructions found in emails, web pages or documents+2If the computer is shared between agents, I only put logins on it that every agent may use+1

“Unknown” means we couldn’t find vendor documentation. It doesn’t mean the control is missing. Weights are our editorial judgement.

Download the trust-zone worksheet