I gave my AI assistant its own user account
Before I let a bot read my email, I gave it a room of its own — with a lock on the door.
I run a personal AI assistant named Marvin on a little server at home. I talk to it over Telegram, and eventually I want it helping with my email and calendar.
Then it hit me: anything I give Marvin access to, a mistake — or a cleverly worded spam email — could get access to as well. So before it read a single message, I moved it out of my account and into its own: a separate user with its own folders and nothing else.
Think of it like a new hire. You don't hand them your personal keyring on day one. You give them a key to their office, and add more keys as they earn them.
Marvin is an OpenClaw agent that originally ran as my login user. I migrated it into a rootless Podman container under a dedicated openclaw user, with shared data under /srv/marvin owned by a group, and the container managed by systemd as a quadlet.
Google access is layered. OAuth scopes are the hard boundary — Google enforces them no matter what the model gets talked into. The agent's own approval rules are a softer layer on top. I started at gmail.readonly + calendar.readonly; anything more means re-consenting on purpose.
[Container] ContainerName=marvin UserNS=keep-id Volume=%h/.config/gogcli:/home/node/.config/gogcli:rw
What I took away: set the hard limits first, then tune the soft ones. Prompt instructions are policy. Scopes and Unix permissions are physics.