Least-privilege access
Each conversation works in its project's folder, and changes outside it need approval. Some actions always ask first, like deleting a calendar event or sending mail. Private projects keep their conversations on an encrypted drive.