Practical Tips

Tips discovered while operating interactive coding agents, persistent assistants, and scheduled automation in real use.

Restrict email sending

I use Fastmail's API for sending email, but the bot is restricted to a specific list of allowed recipient addresses. An unrestricted AI with email access is a spam cannon waiting to go off. Start with zero allowed recipients and add them one by one as legitimate needs arise.

Allowlist web browsing

OpenClaw's browser starts with zero allowed domains. Every domain is added deliberately as a specific task requires it. This prevents the AI from wandering the web unsupervised and avoids accidental data leakage to unknown services.

Separate credentials by scope

Don't give your assistant one set of keys that unlocks everything. Segment credentials by service and only provide what's needed for each task. My credentials are organized as individual env files per service, and each tool only sources what it needs.

Route models by role

A persistent assistant running jobs around the clock can burn through API credits quickly. Prefer subscription-backed access where it is supported, but keep model selection in one central policy rather than hardcoding a provider into every job. Different roles may need different providers for capability, independence, privacy, or cost.

Make fallback visible

Fallback keeps a service available, but it can also change the provider, billing source, privacy posture, or behavior without anyone noticing. Monitor the model actually used, alert when fallback begins, and send a recovery signal when the primary route returns.

Audit regularly

Periodically review what your assistant has access to, what it's doing, and whether the permissions still make sense. Capabilities creep up over time — a tool that only needed read access six months ago might now have write access to three more services than you realized.

Also audit persistent AI execution settings. Hooks and tool configuration can run code on every interaction and survive long after the package or experiment that introduced them has been forgotten.

Label scheduled job outputs

When you have many scheduled jobs, notifications quickly become noise. Give every job an explicit delivery route and a concise label — something like "Email check —" or "HelpDesk triage —". Jobs should remain silent when there is nothing actionable to report.

Verify the execution host

Shared files and remote sessions make it easy for an agent to believe it is running on a different machine. Derive host identity from local machine evidence and a shared environment map before SSH or infrastructure changes. Refuse self-SSH and stop when identity evidence conflicts.

Record synchronization ownership

Do not infer that a folder uses Syncthing just because similar files appear on two machines. Record which mechanism owns each path. In my setup, Obsidian vaults use Obsidian Sync and the shared AI runtime uses Syncthing.