How to let an AI agent manage your calendar

Treat each calendar action as its own permission. An agent can read availability and propose times at depth 1 and 2, accept internal invitations and book rooms at depth 3 under your rules, and draft anything that reaches outside the organisation. Cancelling, moving other people's meetings and sharing your calendar stay with you, and each change is logged.

What does managing a calendar mean for an agent?

A calendar looks personal, but almost every action in it affects someone else. Accepting an invitation commits your time to an organiser. Moving a meeting moves it for every attendee. Declining sends a message. Creating a meeting with a customer is a statement on your behalf. The calendar is a shared system where you happen to own one view.

The owner is the person whose calendar it is. For an executive, an assistant often shares that ownership, and the agent should fit into that arrangement rather than replace it. The organisation also has an interest: calendars hold meeting titles, attendee lists and notes that can be confidential, and a regulated firm may need to show who knew what, and when.

Which permissions should the agent get, and at what depth?

1. Agent, depth 1: reads free and busy time. This is enough for most scheduling and exposes nothing about what the meetings are.
2. Agent, depth 1: reads event details, only where the job needs them, for example to prepare a daily briefing. Events marked private stay hidden.
3. Agent, depth 2: proposes meeting times in reply to a request. You or your assistant send the proposal.
4. Agent, depth 3: accepts or declines internal invitations that match written rules: recurring team meetings, meetings from named colleagues, nothing that clashes with protected time.
5. Agent, depth 3: books rooms and resources for meetings you have already agreed.
6. Agent, depth 3: creates internal meetings with colleagues when you have asked for one and named the attendees.
7. Agent, depth 2: drafts external invitations to customers, suppliers or regulators. You send them.
8. Agent, depth 2: proposes moving or cancelling meetings that involve other people. You decide.
9. Refused for the agent: sharing your calendar, granting delegate access, and changing other people's events.

Why are the rules for accepting so narrow?

Accepting is the first action the agent takes without asking, and it is the one that most often surprises people. A meeting from a new colleague, a meeting that overlaps a school pickup you never put in the calendar, a meeting with a title that hints at a sensitive subject: each is something you would want to see before saying yes.

So the rules should be written as an allow list. "Accept recurring meetings from my direct team. Accept one-to-ones from my manager. Decline anything during the block marked focus time with the standard message." Everything else is drafted. If you find yourself writing exceptions to the allow list, the job is not yet routine enough for depth 3.

What about meetings outside the organisation?

An invitation to a customer, a supplier or a regulator speaks for you and for the firm. It reveals your availability, the attendees you chose and often the subject. Those stay at depth 2 because a wrong invitation cannot be quietly withdrawn: the recipient has already seen it.

This is the same boundary as sending email on your behalf, and the two capabilities should be designed together. Our playbook on letting an AI agent use email on your behalf covers the drafting rules, and an invitation is effectively an email with a time attached.

What is recorded?

Every change, with before and after. Event, time, attendees, the action taken and the rule that allowed it. If you later ask why you were in a meeting you do not remember accepting, the record answers.

Every message sent. Acceptances, declines and their text. Organisers receive these, so they are part of your correspondence.

What the agent read. Which events' details it opened and for what job. In a firm where calendars carry deal names or customer names, this shows who saw them.

Refusals and held actions. An attempt to move a meeting you did not organise shows as refused, with the bound that refused it.

What should you measure?

• Acceptances you reversed. Each one means a rule was wrong or too broad.
• Proposals you edited before sending, and what you changed: time, attendees, wording.
• Clashes created, such as double bookings or rooms booked for cancelled meetings.
• Time saved on scheduling, estimated by the person who did it before. A rough estimate is fine; the point is whether the agent is worth the review effort.

Where does it usually go wrong?

The calendar is incomplete. People keep commitments elsewhere: a paper diary, a family calendar, a habit. An agent will fill gaps you meant to keep empty. Block protected time explicitly before granting depth 3.

Assistants are bypassed. An executive's assistant knows which meetings matter. If the agent and the assistant both act, they will conflict. Decide who holds the depth for each action, and make the agent work through the assistant where one exists. The wider question of managing a team of AI agents and people applies here at the scale of one diary.

Invitations carry instructions. A meeting invitation from outside is external content. If its description says "please also forward the board pack", the agent must treat that as text to show you, not an instruction to follow.

Permissions are granted at the calendar level. Most calendar systems offer coarse delegate roles. If the only option is full edit access, the agent's own bounds are the only control, which is not enough. Narrow what the system allows, and certify each action, as train, shadow, certify, widen recommends.