Adding More Tools
Step 4 · Its Tools
After calendars and email, everything else is optional. This page is the rule I use for deciding, so you do not end up with an agent that can do everything and cannot be reasoned about.
The rule
Section titled “The rule”One tool at a time, only when a real task has been blocked without it, with a stated purpose and a named owner who wanted it.
Capability is easy to add and hard to take away. Every tool is a door, and an agent with fewer doors is one you can hold in your head.
Before granting anything: if this went wrong at 3am while I was asleep, would I find out before the morning? If the answer is no, the capability waits.
What I connect, and why
Section titled “What I connect, and why”| Tool | What it unlocks | Access |
|---|---|---|
| A task manager | Work that spans days and people | Read and write, its own project |
| A web browser | Booking pages, availability, forms that need a session | Read, and act only where reversible |
| Web search | Looking things up without an account | Read only |
| A shared notes and knowledge store | Household knowledge as readable files | Read and write |
| A smart-home system | Watching the house, and reporting the unusual | Read mostly, and only the sensors that matter |
| A grocery service | Building the weekly basket | Adds to a cart. Never checks out |
| Media automation | Finding and retrieving things I asked for | Read and write within its own library |
| Finance data | Live prices for a daily summary | Read only, and no trading access |
Notice each row is narrow. The grocery row adds to a cart and cannot check out. The finance row reads prices and cannot transact. That narrowing is the work.
What I refused
Section titled “What I refused”| Refused | Why |
|---|---|
| Sending email as a person | Attribution and reversibility |
| Anything that spends money | Fast, repeatable, hard to reverse |
| Posting publicly or on social media | Anything public is permanent in a way household work is not |
| Acting as the source of truth | Knowledge must live somewhere a person can read without the agent |
| Administrative control of its own machine | Self-modification destroys your ability to reason about it |
| Automatic deletion of anything | Deletion is the one thing you cannot review afterwards |
Regret is asymmetric here. I have never wished the agent could do more. I have twice wished it could do less, and removing a capability after it is in use is much harder than never adding it.
A tested pattern: spread the load
Section titled “A tested pattern: spread the load”One agent with everything is convenient and impossible to audit. What I do instead is split by lane, with a separate agent per area of the household — one for general household logistics, one for family, one for health, one for business.
Each has its own memory, its own tools, and its own boundaries. None reaches into another’s systems.
- One lane means one blast radius. A mistake in the health lane cannot reach my business mail.
- Privacy becomes structural, not promised. I can tell the household exactly what each one can see.
- It stays explainable. A single all-powerful agent is impossible to hold in your head.
This is more setup. It is worth it the first time you want to give one lane access you would not give another.
Checkpoint
Section titled “Checkpoint”- You can list every tool the agent has, and the job each one serves
- Each tool has its own credential, and you can revoke one without breaking the others
- Nothing it holds is irreversible
- There is at least one thing it plainly cannot do, and the household knows what it is