A parent's guide to what an AI should never be allowed to read
Not every folder deserves a connection. Here is the sorting exercise we run with families to decide what an AI may read, what it may read and change, and what it must never touch at all.
A father asked, halfway through connecting an AI assistant to his email for the first time, whether he should also just connect the family's shared banking folder "while we're at it, to save time later." We said no immediately, and he looked genuinely surprised - not offended, just surprised that the answer wasn't automatically yes.
That instinct - more access now saves a step later - is exactly the instinct this level exists to slow down. Not every folder deserves a connection, and deciding which ones do is a family decision, not a technical one.
What should I not connect an AI to?
We run a simple three-pile sort with families, and it works because it forces an actual decision on every item instead of one blanket yes or no.
- Fine to connect - a shared calendar, a school events folder, a public reading list.
- Connect with care, scoped narrowly - one specific project folder, not the whole drive it lives in.
- Never - financial accounts, medical records, anything containing another family member's private information, any account a child does not already have independent access to.
Why the middle category is the one that goes wrong
Families rarely connect a bank account to an AI by accident. What happens far more often is connecting "the shared drive" broadly, not realising it also contains a folder of scanned medical forms from three years ago that nobody remembered was in there. The danger is rarely the obvious case. It is the broad connection that quietly includes something narrow and sensitive inside it.
The risky folder is almost never the one you thought about. It's the one riding along inside a bigger connection nobody re-checked.
A rule worth writing down
One honest limit: a list like this needs revisiting. A folder that was safe to connect a year ago can quietly start containing something sensitive without anyone updating the sort. The next article in this level covers the other half of the same problem - not what to connect, but how completely and quickly to take a connection back once it should end.
Questions we get asked
What should an AI never be allowed to read?
As a firm baseline: financial accounts, medical records, any private information belonging to another family member, and any account a child does not already have their own independent access to. Beyond that baseline, sort remaining folders into fine to connect, connect with narrow scope, or never - as a family, out loud.
Is a shared family folder safe to connect to an AI?
Only if someone has actually checked what is inside it recently. The most common privacy mistake is not connecting something obviously sensitive - it's connecting a broad folder that quietly contains something sensitive inside it, like an old scanned document nobody remembered was there.
How often should a family review what an AI is connected to?
Regularly enough that a connection nobody remembers granting doesn't sit active indefinitely - a good rule of thumb is checking active connections every few months, and any time a new sensitive file gets added to a folder that is already connected.