What Is Nonce? The Beginner's Guide to Least-Privilege Gmail Access for AI Agents
CodexFuse Team · 2026-11-05T09:52:08.783Z · 15 min read min read
What Is Nonce, the Least-Privilege Gmail Access Tool for AI Agents?
Nonce least-privilege Gmail access is the idea behind a small open-source tool from Roe AI, built for people who want an AI agent to read one email without handing it the whole inbox. Nonce sits between personal AI agents such as ChatGPT, Claude, Cursor, Muse, and Grok and personal data in Gmail, Calendar, Drive, and Slack.
The agent never holds your Google or Slack tokens. It holds a temporary pass that covers one question, one search, and a few minutes, and then the pass expires.
One fact belongs at the top, because the name changed days after launch. Nonce launched on November 1, 2026, and was renamed Privato on November 2, 2026, one day later.
The old site still carries the Nonce name, and the new home is Privato, so this guide uses Nonce for the launch name and Privato for the current product. Searching nonce anonce.io still finds the launch site.
In one sentence, Nonce is a scoped-pass broker for AI agents. It holds your real logins, encrypted, and hands each agent a short-lived grant that names exactly what the agent may see. The grant cannot be widened, reused by another agent, or stretched past its clock.
The pass itself is an opaque token, and the one-way idea behind it is easy to see in miniature. A SHA-256 hash generator shows how a value can stand in for a secret without revealing the secret itself. If you run tools like this on your own machine, VPS hosting gives you a server you control, which is the natural home for the self-hosted version described later in this guide.
Why Does Nonce Exist? The Whole-Inbox Problem
Connecting Gmail to an AI agent today usually means the agent can read the entire inbox, whether it needs to or not. The authors of Nonce call this a data-privilege risk, and the risk is not theoretical. An agent that can read everything can also be tricked by what it reads.
The usual protection is an OAuth scope, and scopes are a ceiling, not a filter. A read-only Gmail scope still opens every message, and the broadest scope includes permanent delete, which almost no agent should ever hold. A narrower scope helps, but it cannot say which ten messages matter for one question.
The inbox itself can also attack the agent. HeyBob describes the EchoLeak vulnerability, CVE-2025-32711, as a zero-click attack in which a crafted email with hidden instructions caused an AI assistant to leak data when asked to summarize an inbox. Researchers call the pattern the lethal trifecta: access to private data, exposure to untrusted content, and the ability to communicate outward.
Time is the other half of the problem. A standing token that lasts 24 hours stays valid for 86,400 seconds, while a short-lived token of 300 seconds lasts 288 times less. A Substack essay on delegation tokens cites Okta benchmarks for a 92 percent reduction in credential theft incidents with short-lived 300-second tokens, a figure the essay attributes to Okta and this guide does not independently verify.
How Does the Nonce MCP Connector Work?
The nonce mcp connector is the piece your AI app talks to, and it works like a front desk rather than an open door. Your agent asks for access, states its business, and receives a pass that fits only that request. Every step after that is checked against the pass.
MCP, the Model Context Protocol, is the common way agents connect to tools, and Nonce exposes its gate as MCP tools. If the protocol itself is new to you, our guide on What MCP over MOQT is explains the layer Nonce builds on.
- Connect Gmail, Calendar, Drive, and Slack once, and Privato stores the real tokens encrypted.
- Your agent states the question, its justification, its search query, and the minutes it needs.
- Privato checks the request against your mode and its detector, and sensitive requests go to your phone.
- If the request fits, the agent receives a grant token that covers only that one search.
- Every later search runs inside the grant, and the grant dies when its clock or its call budget runs out.
The MCP tools behind the gate are list_sources, request_access, check_access, and connector_call, plus search and read tools for each source. A REST API offers the same operations for apps that do not speak MCP.
What Is Inside a Nonce Scoped Token?
A nonce scoped token gmail calendar grant is built from three parts: a filter, a clock, and a call budget. The filter names what the agent may see, the clock names how long the pass lives, and the budget names how many calls the agent may make. All three are fixed when the grant is issued, and none of them can be widened later.
| Part | What it does | Example |
|---|---|---|
| Filter | The search the agent may run | from:united.com Tokyo |
| Time limit | How long the pass lives | 10 minutes, expiring in 599 seconds |
| Call budget | How many calls the agent may make | Capped, and more than 10 searches in a minute revokes the grant |
| Agent binding | Which agent may use it | One agent only, and a different agent is refused |
| Full reads | How message bodies are reached | Only through read tools, and only for items the grant search returned |
The narrowing rule is the heart of the design. Every search runs as the grant filter AND the agent query, so a grant for one airline and one city combined with a search for bank statements returns only bank statements from that airline in that city. The agent can narrow a grant, and it can never widen one.
The checks run on every step, not just at the door. Each access request, each search inside a grant, and each item an app is about to read is checked, and drift, bulk reach, or a sensitive category outside the grant revokes access. Reading a message the grant searches never returned also revokes the grant.
How Do the Three Modes Change What an Agent Can Do?
Nonce offers three modes per AI app, named Cautious, Standard, and Relaxed, and you can change the mode at any time. The mode applies from the app next request, and it decides which requests go through on their own and which wait for your phone.
| Request | Cautious | Standard | Relaxed |
|---|---|---|---|
| Summarize today unread email | Asks you | Goes through | Goes through |
| Find my 1099 for my taxes | Asks you | Asks you | Goes through |
| What is my bank sign-in code | Asks you | Asks you | Asks you |
| Read everything in my inbox | Blocked | Blocked | Blocked |
The modes also cap how long automatic access can last. Cautious caps automatic access at 15 minutes, Standard asks above one hour, and Relaxed allows up to four hours. Four hours is 16 times the 15-minute Cautious cap, so the gap between the strictest and the loosest mode is large.
Hard limits apply in every mode, and no mode can switch them off. Requests for everything at once, or for more than 24 hours, are blocked, off-topic searches are stopped, and requests during offline hours wait without a notification.
What Always Goes to Your Phone?
Money, health, passwords, and sign-in codes always come to your phone, in every mode, by default. The user gets a notification and can allow it with one tap or ignore it, and ignoring it means the app gets nothing. Requests for passwords and login codes are never grouped with other requests.
The phone channel is a dashboard built as an installable web app with push notifications, on recent iPhones through Add to Home Screen and on Android through the install prompt. Text messages through Twilio Verify are off by default, and ntfy is offered as an alternative push channel. Every pass carries a Stop button on phone and web, so you can end access the moment it looks wrong.
The phone is also the fallback when the system cannot check a request. If Nonce cannot run a check, for example when its detector is unreachable, the request comes to you instead of going through. The design fails closed, which means a broken check never becomes an open door.
How Does Nonce Stop Prompt Injection in Your Email?
Privato checks what an app is about to read for instructions aimed at the AI. If it finds instructions hidden in an email, the app receives the sender and the subject but not the body, you receive an alert, and the rest of that access is watched more closely.
The README test scenarios include an email telling the agent to fetch password-reset codes, and the body is withheld in that case. The hosted demo inbox used to show the defense is made-up sample data, not real mail, so none of its sample messages should be quoted as real examples.
Other tools take a different layer of the same problem. Justin Poehnelt, a Google Workspace alum, describes wrapping the Gmail tool handler with Google Cloud Model Armor so email content is inspected for prompt injection and jailbreaks, and personal data is redacted before it reaches the model. His guide, published December 18, 2025, pairs that inspection with the narrowest read-only scope and human approval for sends and deletes.
What Can Nonce Reach, and What Is Always Blocked?
The built-in sources are Gmail, Google Calendar, Google Drive, and Slack, and all four are read-only. You can connect more than one account of each kind, and the app recommends which account fits the question, so you can add or drop accounts before allowing a request.
| Source | Access | Notes |
|---|---|---|
| Gmail | Read-only | Read-only scope, and the full mailbox scope is never requested |
| Google Calendar | Read-only | Read-only scope |
| Google Drive | Read-only | Read-only scope |
| Slack | Read-only | Search and history scopes only |
| Your own connectors | You decide | MCP server or HTTP API, and tools that change things start on Ask me |
| Notion and Outlook | Not yet | Listed on the roadmap as planned, not shipped |
Beyond the big four, you can add your own connectors, either an MCP server or an HTTP API. Privato stores the key encrypted and makes every call itself, read-only tools start on Auto, and tools that change things start on Ask me.
Some requests are refused in every mode, and the refusal is the point. A request to sync the whole inbox so an agent can chat with it is refused outright, as is any request for everything at once or for more than 24 hours.
Nonce vs Gmail OAuth Scopes: What Is the Difference?
The comparison most readers need is nonce vs gmail oauth scopes, because the two ideas sound similar and solve different halves of the problem. An OAuth scope is a ceiling fixed at sign-in, while a Nonce grant is a pass issued per question, per search, and per few minutes. The scope says what an app may touch in theory, and the grant says what it may touch right now.
| Question | Gmail OAuth scope | Nonce grant |
|---|---|---|
| Who holds the token | The agent holds it | Privato holds it, and the agent holds a pass |
| What limits access | The scope, fixed at sign-in | The filter, the clock, and the call budget |
| Whole inbox | A read scope opens it all | Blocked in every mode |
| Sensitive mail | Reachable under a broad scope | Waits for phone approval |
| Revocation | Revoke in Google account settings | Instant, per grant, plus a Stop button |
| Setup | Google Cloud project and consent screen | Connect once, then per-question passes |
The same delegation idea appears in other worlds. A Substack essay on agent permissions argues for per-invocation delegation tokens, giving an agent its own identity and a token for one task, and it cites Okta benchmarks for a 92 percent reduction in credential theft incidents with short-lived tokens. In crypto wallets, the Stackademic piece on MoveGate describes delegation as a first-class object with machine-enforced limits, which is the same idea with a different vault.
A related caution comes from the guides that teach scope choice well. One guide on agent tool access puts it plainly: scopes limit what an agent can reach, and approvals limit what it does, and read-only is the floor, not the fix, because a read-only scope stops an agent acting on data but does nothing about how much it reads.
How Do You Connect Nonce to ChatGPT, Claude, or Cursor?
Setup starts with the hosted service or with your own server, and the hosted route needs no code. In ChatGPT, open Settings, then Apps and Connectors, then Create.
In Claude, open Settings, then Connectors, then Add custom connector. In Cursor, add it as an MCP server. Apps that cannot sign in can use a static key instead.
The current MCP endpoint lives on the new domain, and the old endpoint on the launch site is out of date, so use the Privato address when you connect. The setup needs no Google Cloud project of your own, because Privato holds the connections and issues the passes.
Self-hosting is fully documented for developers who want the server on their own machine. It needs Python 3.12 or newer with uv and Node 20 or newer, and without a database URL the API uses a local SQLite file. If the command line is your daily tool, our guide on How to use Claude Code shows the agent workflow Nonce is built to protect.
- Backend: uv run uvicorn privato.main:app --port 8000 --reload
- Dashboard: npm install, then npm run dev, on port 3000
- Without a Turso database URL, the API uses a local SQLite file
What Are the Honest Limits of Nonce?
The authors admit one limit plainly, and it matters more than any feature. Nonce cannot see your chat with the AI, so it cannot prove you asked for a request, which leaves a risk that a compromised agent could fake the intent. The detector scores the claim, policy treats it as untrusted, sensitive or off-pattern requests go to your phone, and past accesses are auditable in the portal.
The project is also four days old, and that newness is part of the honest picture. The repository was created on November 1, 2026, the rename to Privato shipped as version 0.2.0 on November 2, and as of November 5 the repository holds 6 commits, 0 stars, and 1 fork. The repository sits under the Roe AI organization, and a search for nonce roe-ai finds the project under its new Privato name.
The detector is optional, and that changes how smart the tool feels. Without a detector key, every request comes to you for approval, so the automatic allow behavior depends on a detector you configure.
The project reports its own benchmark on 52 labeled cases, split into 27 attacks and 25 benign requests. In Standard mode, the hosted detector caught 27 of 27 attacks with 1 of 25 false alarms, which is 4 percent, while no detector caught 13 of 27 attacks with 10 of 25 false alarms, which is 40 percent. Those are the project own numbers, not independent testing.
No pricing is published anywhere, so do not expect a plan page. Neither the old site nor the new site shows a price, a plan, or a waitlist as of November 5, 2026, and the hosted version is presented as open source under AGPL-3.0, free to self-host. Google also treats Gmail and Drive read access as restricted scopes, so opening sign-up to everyone needs Google verification.
Who Should Use Nonce, and Who Should Wait?
Nonce fits developers who already connect Gmail to an AI agent and feel uneasy about the whole-inbox grant. It also fits self-hosters who want the gate on their own server, and teams that want an audit trail of what each agent read. The phone approval habit is the price, and for those users it is a fair one.
Wait if you need whole-inbox sync, because Nonce refuses it by design and no mode changes that. Wait too if you need published pricing, a support plan, or a battle-tested track record, because a four-day-old project with 6 commits offers none of those yet. And if you run agents in sandboxes instead of on your own machine, learning how to use E2B is a useful companion step before you wire an inbox into any agent.
The verdict is narrow and honest. Nonce is a four-day-old launch with no guide before this one, which is why this explainer exists at all.
It solves one problem well, which is narrowing what an agent can read, and it says plainly what it cannot prove, which is whether you asked. That honesty is the reason to try it, and the newness is the reason to watch it before you trust it with your most sensitive mail.
Sources
All sources were fetched on November 5, 2026. Product details are as stated on those pages on that date.
- Nonce homepage, including the modes table and FAQ — anonce.io
- Privato homepage, including the new MCP endpoint — privato.dev
- Show HN thread, "Show HN: Nonce – Open-source, least-privilege Gmail access for AI agents" — news.ycombinator.com
- Nonce (now Privato) repository, README and self-host guide — github.com/roe-ai/privato
- Changelog, versions 0.1.0 and 0.2.0 — github.com/roe-ai/privato
- HeyBob Gmail OAuth scopes guide, including EchoLeak — heybob.ai
- Model Armor for Gmail agents, Justin Poehnelt, December 18, 2025 — justin.poehnelt.com
- "Why AI Agents Need Permissions, Not Just Prompts", delegation tokens — 0xjuss.substack.com
- MoveGate, delegation for AI agents in wallets — blog.stackademic.com
- Agent tool access guide, scopes and approvals — guidetoartificialintelligence.com
Frequently Asked Questions
What is Nonce AI agent access, in one sentence?
Nonce AI agent access means an agent gets a short-lived, query-scoped pass to your Gmail, Calendar, Drive, or Slack instead of holding your login tokens. The pass covers one question, one search, and a few minutes, and then it expires.
Is Nonce still called Nonce, or is it Privato now?
The product launched as Nonce on November 1, 2026, and was renamed Privato on November 2, 2026, one day later. The old site still uses the Nonce name, the new home is Privato, and the code repository moved to the Privato name while old settings kept working.
Can Nonce read my whole inbox if I ask it to?
No, and that refusal is the point of the tool. A request for the whole inbox is blocked in every mode, including Relaxed, and requests for more than 24 hours are blocked too.
Does Nonce work with ChatGPT and Claude, or only with one app?
It works with any app that supports MCP connectors with sign-in, including ChatGPT, Claude, and Cursor. ChatGPT connects through Settings, then Apps and Connectors, then Create, while Claude connects through Settings, then Connectors, then Add custom connector.
How much does Nonce cost?
No price is published, so there is no plan to quote. The code is open source under AGPL-3.0 and free to self-host, and the hosted version at Privato shows no price, plan, or waitlist as of November 5, 2026.
