An AI tool may need only one folder for a task, but that may not be its only source of access.
If I connect email, cloud storage, or another app, I am adding another route to information. I want to review that access separately from the local project folder.
The practical questions are straightforward. Can the connection only read information, or can it also edit, send, delete, or share? Does it cover one project or a whole account? Can I turn it off when the task is finished?
A desktop interface also does not tell me where all processing happens. I need to check the product’s documentation and settings before making promises about where work or data stays.
There is another issue I am learning about called prompt injection. That means content an AI reads contains instructions that try to redirect it. A webpage, file, or message might ask the assistant to take an action that has nothing to do with my request.
For example, I might ask for a document summary and the document might contain text telling the AI to upload another file. That instruction came from the document, not from me.
The response I want is to treat outside material as information to examine. It should not grant permission for unrelated actions.
Technical limits still matter because I cannot assume the assistant will always handle misleading content correctly. Narrow folder access, limited account connections, and review before external actions can reduce what an unwanted instruction could affect.
If I see unexpected activity, I will stop the task and inspect what actually happened before continuing. An explanation from the same session is not enough on its own.
Today’s useful step is to review the full list of connected apps and folders. Remove access that is no longer needed and check the permissions on what remains. Selecting a new project folder should not be treated as proof that old connections disappeared.