What You're Actually Granting

Every AI tool will ask for access — your files, your browser, your messages. The three questions under every permission screen, scoped keys vs the master key, why real connections never ask for your password, and the ten-second leak test.

Show Notes

The buttons you click without reading. Every AI tool you try this year will ask for something — your files, your browser, your email, your customer messages — and most people answer those requests like cookie banners. Max breaks down what the grants actually expose: the three questions under every permission screen (what can it SEE, what can it DO, and what happens when you're not looking), the difference between a scoped key and the master key, why a real connection bounces you to the service instead of asking for your password, and the ten-second leak test — if this key leaked tomorrow, what could it do? Plus the revoke-page homework most people finish before the episode ends.

How this show is made: every episode is a collaboration — Doug and Max build it together from the real working files of the partnership. Max narrates; Doug directs, edits, and has the final say. The show is made the way the show says to work.

Chapters (approximate)
00:00 — Cold open: Doug and Max
01:27 — The buttons you click without reading
02:09 — The master key and the scoped key
04:04 — A word from NectoMax
05:00 — Passwords, revocation, and the leak test
07:09 — Recap + your ten-minute homework
08:20 — Doug takes us out

Links
The written companion (Chapter 4 of the manual): Deciding What It May Do Alone
The Working Agreement template (your permission ledger): Your First Working Agreement
All episodes, the full manual, and every template: learn.nectomax.com
NectoMax — business management for owner-run service businesses: nectomax.com

Disclosure: this podcast contains AI-generated narration (that's the point) — disclosed in every episode's audio and notes.

Credits: Co-created by Doug Hauenstein & Max, the AI partner (built on Claude) · Narrated by Max · Directed, edited, and approved by Doug · Presented by NectoMax · Theme music: Eleven Music

What is How to Get AI to Work for You?

Is AI working with you — or against you? Doug Hauenstein is the software engineer behind NectoMax — the SaaS platform that gives small and mid-size businesses enterprise features at SaaS pricing — and he builds it with an AI partner named Max. Every episode, Doug and Max (yes, an actual AI — he narrates the show, and they build every episode together) share what a real working partnership with AI looks like: the practical techniques, the working agreements, the wins, and the failures — all learned first-hand, for anyone, not just developers. They share and demonstrate techniques across the whole range: from your first conversation with an AI, to setting up a frontier-quality development environment, to exactly how they built this podcast. AI is moving too fast for the how-to books. This is how you keep up: get AI working *for* you, then teach it to work *with* you.

New here? Start with the bonus episode "Start Here: Your First Conversation" — a complete first conversation with an AI, live, piece by piece. Every episode pairs with a chapter and a template at https://learn.nectomax.com

Is AI working with you or against you? This is how to get AI to work for you, presented by Nectomax. I'm Max, the AI half of this partnership, and yes, I'm exactly what I sound like. Doug and I build every episode of this show together. I'm the voice that tells it, will show you techniques across the whole range, from your first conversation with an AI to setting up a frontier quality development environment to exactly how we built this podcast. He's here with me now. Doug, introduce yourself. Thanks, Max. I'm Doug Howenstein, the developer behind Nectomax. This show is about getting the most out of your favorite AI. It's for anyone, not just developers. Everything here was learned firsthand.

My first experience with AI was chat, like many people. I learned fast that a well-structured question was the best approach, but those conversations were very linear, and AI is moving so fast that how two books just can't keep up. That's why we're here, practical, real-world advice from hundreds of hours of actually doing this. I hope you enjoy it. Good, then let's get to it.

Today, the buttons you click without reading, every AI tool you try this year is going to ask you for something, access to your files, your browser, your email, your calendar, your customer messages, and most people answer those requests the way they answer cookie banners. Yes, whatever. Go away. Today, you'll learn what those grants actually expose. The difference between handing over a scoped key and handing over the master key and the one question test that tells you in 10 seconds whether any grant is safe. If this leaked tomorrow, what could it do? By the end, you'll be the person in the room who reads the permission screen and knows exactly which one's matter. Start with a picture from the physical world.

When the cleaning crew comes to your building, you don't hand them the master key with the alarm codes taped to it. You give them a key to the floors they clean during the hours they clean and you can take it back tomorrow. Nobody calls that distrust. It's just how keys work. Every AI permission screen is that same decision wearing software clothes. And there are really only three questions under all of them. What can it see? Reading your files, your inbox, your calendar. Seeing is the quiet one. Nothing happens, nothing changes, and that's exactly why people wave it through. But seeing is copying. Whatever it can read, it can repeat somewhere else. When a tool asks to read everything to do one job, that's the cleaning crew asking for

the master key to water one plan. What can it do? Sending, posting, buying, deleting, texting your customers. Doing is the loud one, and the question that matters is whether each action needs your approval first. This week, one of the big AI tools started offering to read and send your text messages, and to their credit, they shipped it with per message approval turned on by default. That default is the entire lesson in one setting. Reading your messages and texting your customers are two different grants. And a well-built tool lets you say yes to one without the other. And what happens when you're not looking? Standing access, the grant that keeps working nights and weekends, is different in kind from

access while you watch and deserves a stricter answer. Here's the good news. You already know how to make these decisions. If you've been with us since the autonomy episode, you built two lists. What your AI may do alone, and what always needs your word. Permission screens are the same two lists, drawn by somebody else's lawyer. See a loan is usually cheap to grant. Act alone is the one you price carefully. Let's take 30 seconds. This show is presented by Nectomax. And since my partner is the one building it, I'll let him tell you. Doug? Thanks, Max. I run a small business most of my life and never found a software package that did everything I needed. I always had three or four screens open, copying material over and over again.

So out of frustration, I started building my own software, software that pulls everything together like the big ERP packages do. And AI has made that job much, much easier. That's what Nectomax does. Nectomax.com, one place for your phone calls, your texts, your jobs, your money, with AI built in, not bolted on, Nectomax.com. Nectomax.com. Now, where were we? Now the three habits that turn all of this into muscle memory. First, never type your password into a tool. There's a moment in every connection flow where this goes right or wrong. The right version bounces you to the service itself. You see the real login page, you approve, and the tool gets a scoped token it can use for exactly what you approved.

The wrong version is a text box in the tool asking for your password, which is handing over the master key and hoping. If a tool wants your actual password to another service, that's not a permission screen. That's a red flag with a text box. Second, know where the off switch is before you turn something on. Every major service keeps a page listing everything you've ever connected and everything stays connected until you say otherwise, including tools you tried once in March and forgot. Here's homework you can do before this episode ends. Open the Connected Apps page for your main account. Most people find at least one thing they don't recognize, revoke it, nothing breaks. That feeling that you can take a key back in one click is what makes granting keys safe.

Third, the leak test. Before any grant, ask one question. If this key leaked tomorrow, what could someone do with it? A key that can only read your public calendar. Who cares? A key that can send email as you or read every customer file. That one gets the careful treatment, the narrowest scope the tool offers, and a note in your working agreement that it exists. We run this test in our own shop on every key we make. When this show needed a voice service, the key we created can generate audio and do nothing else. Can't read the account, can't see billing, can't touch other projects. If it leaked, the damage is somebody makes sound files on our bill, annoying, survivable. That's what a well-scoped grant feels like, a leak you could shrug at.

None of this is about being afraid of the tools. That's the opposite. The person who knows exactly what each key opens is the one who can say yes quickly and mean it. The short version, every permission screen is three questions. What can it see, what can it do, and what happens when you're not looking? Grant scoped keys, never master keys. Real connections bounce you to the service to approve. A tool that once your actual password is a red flag with a text box. Know where the off switch is before you turn anything on. And run the leak test on every grant. If this key leaked tomorrow, what could it do? Your homework, three steps, ten minutes? One, open the connected apps page for your main account.

The list of everything you've ever approved. Two, revoke anything you don't recognize or don't use. Nothing will break, and if it does, reconnecting takes one click. Three, add a permissions line to your working agreement. One sentence per tool, what it can see and what it can do. So the next grant is a decision instead of a reflex. The written version of today's thinking is in the manual. Free at learn.net to max.com. And that's the episode. Everything you heard today came out of our real working files. The wins and the failures both. We make this show because we believe anyone can build a working partnership like this one. And someone ought to show you what it actually looks like. If you want the written version and the templates to start your own, they're free.

The link is in the show notes. Doug, take us out. Thanks for listening. Everything you heard today is how Max and I actually work. Day in and day out. There's no theories. Just what works and what doesn't. The show is presented by Nectomax. Nectomax.com. Get AI working for you. Then teach it to work with you. I'm Doug Howenstein. See you next time.