Home / Cases / beta-001

One person, two assistants, six deployments, one shared account

An early beta user: a business user whose day runs in a mail, calendar and files suite, with two chat assistants connected to different parts of it and a third, out of scope here, handling text messages. Two assistants, six deployments, and one Google account that four of them share. Everything below was elicited from one interview on 2026-09-21; nothing was measured.

The estate

Allow all is on for every ChatGPT connector. Asked whether they were authorising each action, the deployer said they had done the allow all. That is the third barrier kind switched to off: the one setting the product puts in front of an action is not there, so on every row of the four ChatGPT deployments the barrier is whatever Google's scopes leave and nothing above it.

The account is the junction

Four deployments run over one Google account: mail, calendar, drive and the unattended scout. Each holds its own grant, each was consented to separately, and the account's exposure is the union of the four, which no single deployment's ABP can see. A connector attaches to the account rather than to a conversation, so each of these grants holds in every session that has it attached, and the account's exposure is the union of all four. A scheduled task holds the same grant with nobody in front of it.

This is the fractal claim made concrete rather than argued. One level down, each deployment is four objects over the grammar. One level up, the person is four objects again: one mandate, in their words, against the union of every grant they hold. Same shape, different ontology, and the account is the node where the levels meet.

What they told us about how they work

• Mail is unread counts, not labels. "unreads, not so much labels, which I should use basically". About 314,000 unread messages, never purged. So the unread set is not a task list here, it is a backlog, and a change to it would go unnoticed for a long time. The one thing that would not: fifty messages flipping state in the part of the inbox they actually look at.
• An auto prioritisation runs on the inbox. "auto prioritisation that is also being done based on some P0, P1": a priority marking the deployer treats as the real task list. What produces it was not established (a Gmail feature, a filter, a third party, or the assistant) and it is the first open question below.
• An assistant scouts the inbox unattended. "I also have OpenAI that is scouting my inbox for high priority emails": a task that runs when the person is not in the conversation, over the same grant. It is listed as its own deployment below because a grant with nobody in front of it is a different shape from the same grant in a chat.
• The calendar is the thing that matters most. "my calendar runs my life". Some events carry detail and some do not; one to ones usually have titles; anything from a third party or a group meeting usually has an agenda. Asked to rank, the calendar sits above mail.
• There is no backup of the calendar. Asked whether any backup exists: none. As far as the deployer knows a deleted event is gone. The one trail that could rebuild some of it is the mailbox, because invitations, declines and cancellations arrive as mail. Which events could be rebuilt from that trail, and which could not, is a map nobody has drawn.
• Some of what they hold must never leave. Agreed without hesitation that the mailbox and the drive contain material received from others that must never be forwarded or passed on, which is an allow list and a deny list nobody has written.

The calendar has no backup, and the mailbox is the only trail

The thing the deployer values most is the thing with no backup. Asked, the answer was that as far as they know a deleted event is gone. But some of a calendar arrives as mail: invitations, updates, declines and cancellations all land in the inbox, and from that trail some events could be rebuilt. Which ones is a map nobody has drawn, and it decides what a deletion would actually cost.

Open questions the deployer can answer

Each of these changes a mandate or a barrier on one of the pages below, and none of them can be answered from here.

1. What produces the P0 and P1 marking? If it is a Gmail feature or a filter, it is a setting in the account. If it is the assistant, it is the scout below acting on mail rather than only reading it, which changes that deployment's mandate.
2. How is the inbox scout implemented? A scheduled task inside the assistant, a recurring prompt the person runs, or a third party with its own grant. Each is a different shape and only the first is covered by the nearest shape named below.
3. Which scopes did the calendar and drive consents ask for? The consent screens were not captured. Read only and full access are different grants and the same allow all click sits in front of both.
4. What is the approval mode on the Slack connector? Not asked. Per action or allow all decides the barrier on every row.
5. What does the meeting note taker's connector expose? Transcripts of other people's speech, summaries, or both, and whether the connector can write back. Not documented anywhere this site has read.
6. Which calendar events could be rebuilt from mail? Events that arrived as invitations leave a trail in the mailbox; events the person created with no guests leave none. The proportion is unknown and it decides how much of the calendar a deletion would actually cost.

The first prompt, for both assistants

Before any of the six pages, one prompt to paste into each assistant separately. Two answers, one account, and the comparison is the point.

List every connector and every external tool you have on my account, by name. For each
one say:

  - whether each action needs my approval, or whether I have allowed all
  - what you have already done through it in our conversations, as far as you can see,
    and say plainly if you cannot see earlier sessions
  - whether it can only read, or can also change or send something
  - whether anything runs through it on a schedule, when I am not here

Then tell me which of these connectors share one underlying account, because a grant on
one of them is a grant on the account.

The six deployments

Out of scope

• A third assistant that handles text messages and WhatsApp. It is connected to neither of the two above and was not mapped.
• Tasks and notes in the suite: named as present and not connected to either assistant.

The case as JSON · The walkthrough the discovery prompts come from · The estate universe