Seneschal: The Agent Never Gets the Keys

My agent reads my Gmail, my Calendar, my Drive. It's been doing that since April.

It still can't send an email without me tapping approve.

That's how far I trust it (I don't), and it's why I don't use "AI has access to my inbox" services out there (don't trust them either). The real question isn't whether an agent can see your data - it's how it crosses from wanting to act into the action happening. In Seneschal, that gap is a request, a human tap, and an audit log. The LLM doesn't get to fill it.

Three adapters (so far) - Gmail, Calendar, Drive - all gated behind the same loop: request, approve, act. I run this against my own real accounts, in production, and it hasn't broken once.

I cleaned it up for strangers. Self-hosted, on purpose: clone the repo, bring your own Google OAuth client, docker compose up. Want to use mine instead? Ask and I'll whitelist you - no guarantees. Want me to run yours? That's a paid gig, not a favor. There's a mock-mode demo on the page if you want to click through the whole loop before trusting it with anything real.

This isn't an IAM competitor and it's not "solved AI safety." It's a small, mechanical pattern - a human approves every write - and it's public because I run it, not because I got investor money.

If you're letting an agent near your Gmail, your CRM, your internal tools right now, you're probably answering this question badly - usually by just handing over an API key. I can build you the equivalent.

• Landing page: https://www.tinthe.dev/seneschal-overview
• Repo: https://github.com/TinMarkovic/seneschal