# He Built an AI Executive Assistant in OpenClaw (Atarim) > [!question] Lingering Questions > - Which one recurring ops task (morning briefing vs. standup prep) is the safest first delegation for a self-hosted agent? > - How is PII exposure actually bounded when one agent persona holds broad read/write access across email, calendar, Drive, and task systems? > [!tip] Article Ideas > - A least-privilege access checklist for an OpenClaw "chief of staff" agent (read-first, approval-gated outbound), drafted from Toothman's onboarding-checklist and human-approval-gate pattern. > [!link] Cross Reference > - [[3. Resources/MOCs/AI Agent Safety MOC]] — the access-scoping and human-approval-gate patterns here are directly relevant to agent-safety design > - [[3. Resources/MOCs/AI & the Future of Knowledge Work MOC]] — a worked example of "agent runs the process," not just a single-task bot > [!quote] Vocabulary > - *Viv* — the name given to the OpenClaw agent persona, engineered by blending four fictional characters (including Lucius Fox from The Dark Knight) > - *systems of record* — the actual tools (Workspace, Asana, transcripts, Slack) an agent must read/write to be operationally useful, as distinct from its persona or prompt ## Metadata - Source: [[3. Resources/Readwise/Full Document Contents/Articles/He Built an AI Executive Assistant in Openclaw, It Runs His Whole Agency]] - Channel: Atarim, 2026 Web Agency Summit clip - Speaker: JJ Toothman (agency operator), interviewed by host Zach ## Author's thesis A short promotional-leaning clip showing agency operator JJ Toothman's recipe for turning a self-hosted OpenClaw agent persona ("Viv") into a quasi-employee running real operations: morning briefings, status reports, standup prep, client-status drafts, pipeline oversight, and a dormant company social account — wired into Google Workspace, Asana, Slack, and a meeting-transcription tool. The framing ("runs his whole agency") is host hype; Toothman himself is more measured, keeping a human approval gate on anything that ships externally. ## Key arguments (≤3) 1. **Integrations, not persona, are the load-bearing work** — "a chief of staff who can't see what's happening isn't a chief of staff," so the unglamorous integration work (Workspace read, Asana, transcripts) is what actually makes the agent useful. 2. **Onboard the agent on the same checklist as a human hire** — define role and daily operational responsibilities, then add it to the team's communication backbone (Slack). 3. **Keep a human approval gate on outbound actions**, even where the agent runs a process end-to-end (the dormant X account), with skills diffusing from personal aide to shared team resource over time. ## Claim atoms ### An assistant that can't see the work isn't a chief of staff > [!quote] ID:rw_pending > "chief of staff who can't see what's happening isn't a chief of staff so the integrations are the unglamorous half of the work that makes all the difference." Frames integrations (Workspace read, Asana, Fathom transcripts) as the load-bearing work, not the persona. ### Onboard the AI agent on the same checklist as a human hire > [!quote] ID:rw_pending > "we have an onboarding checklist and I went through most of that onboarding checklist with the agent. So define the role define daily operational responsibilities." Named "Viv," run through the standard new-hire checklist; added to Slack, the remote company's "backbone." ### Keep a human approval gate on agent outbound actions > [!quote] ID:rw_pending > "sends me the editorial calendar and I have to give it final approval before I can start executing on it." The agent runs a dormant X account end-to-end but a human approves the editorial calendar before publishing. ### One agent's skills diffuse from its owner to the whole team > [!quote] ID:rw_pending > "some of those skills and powers I was giving it would benefit others on the team and eventually became a teammate supporting everyone not just me." Scope crept from personal aide to shared resource with a dedicated Slack channel (standup prep, weekly client status). ## Permanent candidates - This talk's central claim is already captured — see [[3. Resources/Permanent Notes/An Ops Agent Is Only as Capable as Its System Access]] (existing note, sourced from this same doc). No new Permanent created; connect only. ## Processing checklist - [ ] Map an OpenClaw "executive assistant" persona to a least-privilege access design — start read-only, add write/post behind an approval gate - [ ] Open question: which one recurring ops task is the safest first delegation for a self-hosted agent? - [x] Connect into the relevant MOC — [[3. Resources/MOCs/AI Agent Safety MOC]] ## Links - [[3. Resources/MOCs/AI Agent Safety MOC]] — a worked example of access-scoping and human-approval-gate design for an autonomous ops agent - [[3. Resources/MOCs/AI & the Future of Knowledge Work MOC]] — a founder-level case study of an agent running real operational work