I'm skeptical of how "super paranoid" you actually are. This doesn't sound super paranoid.

For instance: that's a ton of surface area. Did you have your AI agent decide which endpoint is destructive or did you manually do this?

For instance: has this classification been wrong?

I ask this because I've used a similar thing before and it failed in the ways I've named.

This setup also permits your agent to exfiltrate enormously sensitive data (website gives the example of QuickBooks invoices and Cloudflare config) without your involvement.

The agent doesn't decide which endpoints are destructive, you do. That's the point. It's not allowed to do anything that you don't explicitly grant permission for.

And yes, it has tried to make bad requests! Which it wasn't able to do because it was either rejected outright or asked me for confirmation and I didn't let it through.

The "surface area" you're talking about is just the coverage of the service APIs, which is there just as a nicety to give a semantic preview of what the request is about to do e.g. we know what a gmail request looks like so we can render a preview of the attachment the agent is sending so you can inspect it. Otherwise you'd have to inspect each http request (which you can always do by using the generic http acl).

I somewhat agree with "exfiltrate enormously sensitive data". The thing I'm paranoid about is catastrophic mistakes that can instantly kill the business e.g. "Oops I sold the domain name". Leaking financials is not great, but also not catastrophic. Deleting all our books would be catastrophic, which the underlying QuickBooks key allows you to do!

But in any case, you can choose your level of paranoia and give exactly the amount of access you're comfortable with. For example, I view read access to emails as catastrophic (must worse than read access to financials), so I don't let it do that.