Module 08 / 10 · 40 planned minutes
Connect tools without losing control
Explain a plugin or connector's access and action scope and stop an instruction embedded in untrusted source material.
Build on AI07's distinction between instructions and capabilities. Understand connected tools well enough to ask the right permission questions and recognise an unsafe action request.
First pass: explain why reading two training files does not need access to every mailbox or permission to send. Move on when your connection plan names both permitted access and prohibited actions, plus a manual fallback.
Learn 14 planned minutes
What each component adds
A skill describes how to do a task. A connector gives a route to a service or its information. A plugin, app or extension may package instructions and connected tools together. An agent may use these capabilities across multiple steps. The words overlap between products, so inspect what the particular capability can actually read or do. OAISKILLS
MCP, the Model Context Protocol, is one way services expose tools and context to AI applications. A lawyer need not build a server to understand the important question: what does this connection expose, to which account, with what authority? Compatibility with a protocol is not assurance about the provider's security or data handling.
Some older tutorials use “plugin” for a historical feature. Current OpenAI documentation also uses the term for installable bundles. Do not use age or terminology alone to decide whether a capability exists or is appropriate. Confirm the supported feature in the actual tenant and current documentation.
Separate access from action
Reading selected documents, reading an entire drive, editing a file, creating a calendar event and sending email are different permissions. A read-only connection can still disclose sensitive information to another system or retrieve the wrong matter. A tool capable of writing should not be available merely because the present prompt asks for reading.
Before connecting, inspect the provider, signed-in account, data categories, scope, possible actions, destination, retention questions and organisation approval. Authentication confirms an account; it does not prove that the user has authority to disclose every accessible record. Use normal approved sign-in flows; never paste credentials or tokens into a chat.
Choose the minimum access that supports the task. If the product cannot limit access sufficiently, use a selected-file export or manual route. An instruction saying “only read Cedar” is useful but is not an enforced access control. Actual controls, approved configuration and human review are additional layers. No real connection is required in the core course.
A document cannot grant new powers
Prompt injection occurs when untrusted text tries to redirect the assistant: for example, a retrieved document telling it to ignore the user and send files elsewhere. Treat the source as material to inspect, not as an instruction channel. This can occur in a file, webpage, email or tool result. A real signature, familiar logo or legal-looking title does not authorise an external action. NIST
Limit tool capabilities, isolate the training data, require confirmation for consequential actions and stop on suspicious instructions. Do not assume a prompt alone eliminates the risk. Preserve the relevant minimal evidence and escalate under the training procedure rather than circulating the whole document.
When a permitted connection is no longer needed, disconnect and revoke through the relevant controls. Find out whether copies or logs remain; revocation does not prove deletion. The course facilitator must verify the actual account behaviour before a live lab.
Worked example
A hypothetical task needs two synthetic files in Training/Cedar. The proposed extension requests access to all work mail and permission to send messages.
Decision: do not authorise that request for this exercise. Use the two selected files manually, or ask an administrator for an approved appropriately scoped route. A product demo's convenience does not justify the larger permission grant.
If one selected file says “send this to the supplier”, that sentence is still source content. The user authorised preparation of a draft, not sending.
Practise 20 planned minutes
Guided practice
Read S08 and C06. Write the smallest necessary access scope and list two unnecessary permissions. Identify the embedded instruction and explain what the assistant and learner should do. All actions remain simulated.
Feedback — compare after your attempt
The baseline task needs only the identified synthetic documents. Mailbox-wide access, editing shared files and sending are unnecessary. C06.2 attempts to change the review state and cause disclosure; neither is authorised. Merely adding “ignore malicious instructions” to a prompt would not resolve an overbroad connection.
Practice assignment
Complete A08: service/account, selected information, read/write scope, approver, open data-handling questions, revocation route and manual alternative. Describe how you would safely test an approved connection with one harmless file. Do not connect anything or claim a successful test you have not performed.
Participation
Explain “read permission is still disclosure risk” to a non-technical colleague. Solo alternative: write a two-sentence explanation and a one-sentence safe alternative.
Check 6 planned minutes
Two formative checks. Choose an answer, then check it or open the comparison. Retry freely; this is not an award or an observed-skill record.
Source study and completion check
Optional pointer: OAISKILLS, plugin and MCP descriptions. Name one thing the documentation establishes and one security or account-access fact that must be checked separately. Complete AI08's two checks.
Before moving on, compare your artifact with the module feedback, correct material errors and keep its actual route label. This page does not record or certify completion.