How do you give an AI agent access to a shared calendar?

Reading and writing are different problems that happen to share an interface. Reading a calendar exposes who the business meets, when, and often why — entries carry client names, candidate interviews, medical appointments, board matters and negotiations in their titles. That is a confidentiality decision about content, and it is answered by scoping which calendars are visible rather than by trusting the agent's discretion.

Writing is the harder half because it has external effects that arrive immediately. Creating an event invites people, moving one notifies them, cancelling one tells them it is off. There is no version of undo that unsends those. An agent that creates a meeting with the wrong customer, at the wrong time, or with a title that reveals something to an unintended attendee has already communicated before anybody reviews it, which puts calendar writes closer to sending email than to editing a record.

The construction that works is a booking rule rather than a permission. Rather than granting write access to a calendar and instructing the agent to be careful, give it one narrow operation — book within these hours, of these durations, in these categories, with these attendees, on this calendar — implemented so that anything outside the rule is impossible rather than discouraged. The agent chooses among permitted slots; it does not choose what is permitted.

Buffers and travel are where automated booking creates a supervision job that did not exist before. A person scheduling knows the site visit before it needs an hour on either side, that two client calls back to back are a bad idea, and that Friday afternoon is when the invoicing gets done. Encoding those as rules is straightforward; discovering them after the agent has booked over them is a week of apologies. Write the rules down before switching it on, from whoever currently protects the diary.

Cancellation and rescheduling deserve their own decision and usually a different answer. Booking into free time is additive and its worst case is a wasted slot. Moving or cancelling an existing commitment takes something away from somebody who planned around it, and the cost is borne by a person who was not consulted. Most businesses should let an agent propose a reschedule and let a person send it, at least until the log shows how often the proposal was right.

Finally, the log is the control that makes the rest reviewable. Every event created, moved or cancelled, with the request that caused it, in a place somebody looks at weekly. Calendars are unusual in that errors are self-reporting — people complain — but the complaints arrive individually and look like isolated mistakes. Seeing them in one list is what turns five awkward conversations into one rule that needed changing.