# How an AI Agent Helps Run This Blog, Step by Step How an AI agent helps run this blog, in plain English: what a Claude routine is, how to set one up, and the short list of things our agent can touch. By Steven Cappiello, Founder of JobKick · Published 2026-10-18 Canonical: https://jobkick.com/blog/ai-agent-without-all-your-passwords/ Topics: AI agents for small business, Claude Code routines, how to set up a Claude routine, AI agent permissions, Telegram bot, least privilege This post got rewritten because of a two-line text message. The first version was a tour of security research. I read it and sent this from my phone: "I wanted the AI agent article to be less of a journalism adventure and more of like how I actually do this." Then: "Let's actually talk about how we do it." A few minutes later, an AI agent woke up, read those messages, rewrote the post, and texted me a link to a preview. Nothing went live. It won't until I reply "ship it." Here's how that works, in plain English. No tech background needed. ## What a Claude routine is Claude is Anthropic's AI assistant. Claude Code is the version that does real work on files: reads them, changes them, checks nothing broke. A **routine** is a job you hand Claude Code once, and it then does on its own. You write the instructions, say where the work lives, and choose when it should run. After that it runs on Anthropic's computers, not yours, so it keeps going while your laptop is closed. A routine can start three ways: - **On a schedule**, like every weekday at 6:00 a.m. - **When something calls it**: another service sends it a message that says "go." - **When something changes in GitHub** (the service where many people keep their website and app files). Ours uses the first two. It runs every morning at 6:00 ET, and it also wakes up whenever I text it. ## What it's good for Routines are good at work that repeats, doesn't need you watching, and ends in something you can check. Anthropic's examples include sorting new requests every night and checking a website after an update. They're not for decisions you'd never want made without you. That's why ours drafts, but never publishes on its own. ## How to set one up You need a paid Claude plan (Pro, Max, Team or Enterprise). Routines are still marked as a preview, so details can change. 1. **Go to claude.ai/code/routines** and click **New routine**. 2. **Name it and write the instructions.** This is the part that matters. Nobody is there to answer its questions, so spell out the job, the rules, and what "done" looks like. 3. **Pick where the work lives.** For us, that's the folder on GitHub that holds this website's files. You can connect GitHub from the same screen. 4. **Pick an environment.** That's the setting for what the routine can reach on the internet, plus any keys it needs to log in to other services. 5. **Pick a trigger:** a schedule, a "call me" address, or a GitHub event. 6. **Remove the connections it doesn't need.** At the bottom of the form, every service you've connected to Claude (email, calendar, and so on) is switched on by default. During a run, it can use all of them without asking. Turn off everything this job doesn't need. 7. **Click Create, then Run now** to watch a first run before you trust the schedule.
Super tipRemember, you can ask your AI agent to walk you through any of this. Copy and paste part of this article into your chatbot and ask it to walk you through it. Tell it to go step by step, one step at a time, so it doesn't overwhelm you.
One thing to know: a routine acts as you. Changes it makes show up under your name. ## How ours fits together Beyond the routine itself, we added four pieces. 1. **A playbook.** The routine's instructions are short. The real ones live in a file next to the website's files: how to research, how to write, the brand rules, and the hard limits. 2. **A SyncUp board.** SyncUp is the project management tool we built here at JobKick, and you can start using it free. [Check it out here](/syncup). Our board is one project, "JobKick Blog." Every post is a task that moves through stages: Idea, Researching, Drafting, In Review, Scheduled, Published. The calendar view is the publishing calendar, and each task's notes are where the agent and I talk about that post. 3. **Telegram.** I don't want to log in to anything to give feedback, so I text a bot. A small go-between service we run holds the bot, saves my messages, and calls the routine's "go" address. The agent picks up my messages, does the work, and texts back. 4. **A preview site.** When the agent finishes a draft, a hidden copy of our whole website rebuilds with the draft on it. I read the post on my phone exactly as readers will see it. ## A normal morning At 6:00 the routine starts on a fresh computer. It reads the playbook, then my pinned notes in SyncUp. One of them, "Voice and rules," overrides the playbook, so I can change how it writes just by editing a note. It handles my messages first. Then it goes through the board. If I left a note on a draft, it makes the change and replies under my note. If I said "ship it," it publishes. If I moved an idea to Researching, that's my go-ahead to start a draft. It never writes its own ideas. It can suggest them, labeled "Suggested," and they wait until I pick one. A new draft means research first. Every number has to come from a page the agent actually opened, with the number found on that page. It writes the draft in a separate copy of the site, checks that the site still builds, and asks me to accept the change. Then it texts me the preview link. At most two posts can wait for me at once. If I fall behind, it stops drafting and asks me questions instead. ## What the agent can touch This is the part I care about most. I'm not handing an AI the keys to everything to get a blog written. It gets what its job needs, and nothing else. Tap any box. The blue lines are the only places our blog agent can reach. Flip the switch to see what "connect everything" looks like. **Chart (access-map): What our blog agent can reach** — An illustration of our real setup, not survey data. The "all-access" view is a generic example, not any specific product. ```json {"center":"Blog agent","compare":{"label":"All-access assistant","center":"Assistant"},"views":["Our blog agent","Connect everything"],"nodes":[{"name":"Website files","short":"Website","access":true,"can":["Read the website's files and posts","Write a draft in its own separate copy","Ask me to accept the change","Publish a post, but only after I say \"ship it\" (a rule, see below)"],"cannot":["Open the files of any of our other apps"],"all":"The files for every app we make."},{"name":"Blog project in SyncUp","short":"SyncUp","access":true,"can":["Read the blog project's tasks and notes","Add notes (each one starts with [agent])","Move a post between stages"],"cannot":["See any other SyncUp project"],"all":"Every project, every team's tasks, every comment."},{"name":"Messages to me","short":"Messages","access":true,"can":["Text me on Telegram, through a go-between we run","Read the messages I send to it"],"cannot":["Hold the Telegram bot's own password","Message anyone but me"],"all":"Your whole chat history and the ability to message anyone."},{"name":"Bank and payments","short":"Bank","access":false,"cannot":["It was never given a login, a card or an account."],"all":"Payment details, invoices, the ability to buy things."},{"name":"Customer data","short":"Customers","access":false,"cannot":["Our apps' customer records aren't connected to it at all."],"all":"Every customer record in every app."},{"name":"Password manager","short":"Passwords","access":false,"cannot":["No vault, no master password, no shared logins."],"all":"The master key to everything else."},{"name":"Other apps' code","short":"App code","access":false,"cannot":["The files for SyncUp, Timely and Sherli live in places it can't open."],"all":"Every product we ship."}]} ``` Each line is a separate, narrow key: - **Website:** it can open this website's files. Not the files for our apps. - **SyncUp:** a key to one project. It can't see any other. - **Messages:** it talks to our go-between, never to Telegram directly, and it can only message me. Every note it writes starts with "[agent]", so I can always tell its words from mine. To be straight: some of our other agents do get email access. This isn't "never give an AI anything." It's "give it the right key for the job." ## Why the limits matter Two numbers explain it. - **22%** of breaches started with stolen or misused passwords and logins, the most common way in (source: Verizon DBIR 2025 · 12,195 breaches, https://www.verizon.com/about/news/2025-data-breach-investigations-report) - **11.2%** of hidden-instruction attacks still worked on Anthropic's browser agent, even with its newer defenses (source: Anthropic, Aug 2025 · 123 test cases, https://claude.com/blog/claude-for-chrome) The first says logins are the front door attackers already use. Every password you give an agent is one more copy that can leak. The second is about hidden instructions: text tucked into an email or web page that tries to take over what an AI does. Anthropic tested its own browser agent before release. Without extra safeguards, those attacks worked 23.6% of the time. With better defenses, 11.2%. Real progress, and still about one in nine. You can't make an agent impossible to fool. You can make sure that when it's fooled, it can't reach much. ## What it costs Here's every piece, with its price: - **Claude:** routines come with a paid Claude plan, with no separate fee. Pro is $20 a month, or $17 a month if you pay for a year up front. Max starts at $100 a month. Each run uses up part of your plan's usage, the same as working with Claude Code yourself. If you hit your limit, new runs are turned away until it resets, unless you've turned on paid extra usage. - **SyncUp:** free for 1 project with up to 50 tasks and 20 notes. Our blog board is bigger than that, so it needs SyncUp Pro: $6.99 a month or $59.99 a year. - **Telegram:** free. Telegram lets bots message their own users at no cost. - **The go-between and the preview site:** these are the two pieces we built ourselves, and they run on JobKick's own servers. ## The honest weak spot Some of our limits are locked by the systems. The SyncUp key really can't open another project. Others are rules in the playbook, like "never publish until Steven says ship it." The agent follows them. But a rule an AI is asked to follow isn't the same as a door it can't open. The fix is to move the important rules into the systems, like requiring my approval before anything reaches the live site. And the fair counterpoint: this is more setup than clicking "allow all." Our agent can't pay a bill or answer a customer. When I want those, I do them myself, or set up a separate agent with its own narrow key. Nobody's the villain here. "Allow all" is just the easy path, and its cost shows up later, all at once. ## Before you start your own 1. **Write the job in one sentence.** "Drafts blog posts for my review." If you can't, it's two agents. 2. **Give it one place to work:** one project, one folder. Easy to see, easy to undo. 3. **Give it narrow keys, not your passwords.** 4. **Make it show you a preview,** and keep anything public behind your yes. 5. **Know how to pull the plug.** Write down every key it has and how to turn each one off. None of it is hard. The slowest part is deciding what the agent shouldn't touch. ## Want help setting one up? If you run a small business and want an agent helping you without the keys to everything, email me at [hello@jobkick.com](mailto:hello@jobkick.com). I'm happy to talk it through for free. And if you've built something like this, how do you talk to yours? Tell me in the comments. ## Sources - Anthropic, [Automate work with routines](https://code.claude.com/docs/en/routines) (setup steps, triggers, plans; research preview). - Anthropic, [Claude Code on the web](https://code.claude.com/docs/en/claude-code-on-the-web) (how cloud sessions run). - Anthropic, [Claude pricing](https://claude.com/pricing) (Pro $20/month or $17/month billed yearly; Max from $100/month; checked October 18, 2026). - Telegram, [Bots FAQ](https://core.telegram.org/bots/faq) ("bots are able to message their users at no cost"). - JobKick, [pricing](/pricing) (SyncUp free plan and Pro price). - Verizon, [2025 Data Breach Investigations Report](https://www.verizon.com/about/news/2025-data-breach-investigations-report): 22,000+ incidents, 12,195 confirmed breaches. - Anthropic, [Piloting Claude for Chrome](https://claude.com/blog/claude-for-chrome) (August 25, 2025): 123 test cases, 29 attack scenarios. - OWASP Gen AI Security Project, [LLM06:2025 Excessive Agency](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/).