Does a calendar connection let an agent invite other people, or only read your day?

It lets the agent invite other people if the connection can create or change events. It only reads your day if the grant is actually view-only. Those are different permissions, and the connect button often asks for the one that can change events, because “help with your calendar” is sold as scheduling, not as a peek. Adding a guest is not a separate product. It is an edit to an event. If your account’s connected-apps page does not say view-only, or free/busy only, in words you can point at, assume the agent can invite. Disconnect it and paste the day into the prompt if all you wanted was a read.

I am not going to claim every vendor’s 2026 consent screen uses the same sentence. Yours is the one that counts. Read it. Ambiguous means it can invite.

The invite I did not think was included

I connected a calendar so an agent could tell me whether Thursday afternoon was free. The task was a read. The permission I clicked through mentioned seeing and managing events. I treated “managing” as sync. The agent, asked to “hold Thursday for Sam,” created an event and added Sam. Sam got the mail from the calendar provider. I found out from Sam, not from a summary that said “I checked Thursday.” The check and the invite were the same grant. The model picked the verb that finished “hold.”

Nothing about that required a special trick. Create-event was on the tool list because the OAuth grant allowed it. A read-only grant would have made the tool fail or would not have offered it. I had not looked. The button had said connect calendar, and I was in a hurry to answer whether I was free. I was free. Then I was not, because a hold had been sent.

Read, free/busy, and edit are not one dial

A view of your events includes titles, guests, and descriptions. That is already more than “are you free.” A free/busy view, where some products offer it, shows blocks without the titles. An edit grant can create, move, delete, and add attendees. Adding attendees is the invite. If the text says the app can change events, share calendars, or manage them, it can invite. If it says view or read and does not say change, it should not. I use “should” because a buggy tool can still try. The grant is what makes the try succeed. I want the try to fail.

Google’s calendar permissions, as documented for developers, have included a read-only option and broader options that view and edit events. I am not going to tell you which box a given agent product checked in its current app. Open the third-party access page on the account and read the line next to that app. If you cannot find a line, you do not know, and the connection should not stay. “It has been fine” means it has not invited anyone yet. The tool is still there.

Work calendars are worse than personal ones. An edit grant on a work account can invite customers and coworkers and can put a private event’s title into a prompt. A read is already a disclosure of your day into the model’s context and the log. I paste the hours I am willing to share. I do not connect the work calendar to an agent for a one-off “am I free.”

How to check without inviting anyone

Do not test by asking the agent to invite a colleague “just to see.” That test is the damage. Read the permission string. Then look at whether the agent’s tool list includes create, update, or add attendee. If those tools exist, the product expects to use them, and the grant probably allows them. Remove the app. If you truly need a read later, reconnect only if the new consent screen says view or free/busy and the tool list no longer offers create. If the product has a single connect button and no read-only choice, do not connect it. Paste.

After you remove it, look at the calendar for events you did not make, especially holds and “quick sync” titles the model likes. Delete those yourself. An agent with the grant removed cannot clean up as you, and you should not give the grant back so it can delete. You delete. You also check whether a guest was notified. The calendar provider’s mail already went. Revoking the app does not unsend it. A short human note is the fix, not another agent pass.

What a read still costs

Even a real view-only connection pours your day into the prompt: medical appointments, interview names, a child’s school event, a customer call. The agent does not need the titles to say whether you are busy. You can paste “Thursday 14:00 to 16:00 is open” and keep the rest. I do that. The loss is a few seconds. The gain is that a later summary cannot quote a title I did not mean to feed a model, and a log does not store the day.

If you do keep a view-only grant, it is still not an invite grant, and you re-read the permission after the product updates. Updates are when “view” becomes “view and help you schedule” without a new conversation. The connected-apps line is the conversation. If it grew an edit verb, remove it the day you notice.

Rooms, links, and other people’s calendars

An invite is not only a person’s email. Some grants can book a room, drop a video link, or write on a calendar you can edit because a teammate shared it. The agent is then inviting a resource or writing into someone else’s day with your authority. I treat “calendars you can access” as bigger than “your calendar.” If the permission says any calendar you can see, the agent may be able to touch the shared one. That is a reason to refuse the grant, not a reason to hope the model sticks to your personal calendar. Models stick to the task. The task will name the shared calendar the moment someone says “put it on the team schedule.”

Declining and proposing a new time are edits too. An agent asked to “reply that I can’t” can send a counter-proposal to every guest. That mail looks like you. A view-only tool cannot do it. A manage-events tool can. I would rather paste “I can’t, offer Friday” into a draft I send than let the calendar product mail the counter-offer at 11pm because the agent was still running. The clock on an invite is the provider’s, and it does not wait for you to notice the summary.

A second account does not make the grant smaller

People create a scheduling calendar and connect that, which is better than connecting the calendar where the medical appointments live, and it is still an invite grant if it can write. Guests do not care that the calendar was named “bot.” They care that a meeting landed. Keep that calendar empty of private titles if you use one, and do not share it back to your main calendar in a way that copies details across. I still prefer not to connect it until the permission line is view-only or until a human hits send on the invite. A dedicated calendar reduces how much is read. It does not reduce the fact that create-event notifies people.

If the only reason to connect is so the agent can see conflicts, export a free/busy snapshot yourself, or type the open blocks. Both are reads you performed. The agent then schedules in a draft: title, time, guests, as text. You create the event in the calendar app, where the invite button is yours. That is slower by a minute and it is the version where Sam does not hear from a model. I have not found a research or planning task that was worth skipping that minute. Booking is a different decision, and it is still a human send unless you have accepted that the grant invites.

The answer I give when someone asks me to connect theirs

I ask what the consent screen says, not what the agent’s marketing says. Marketing says it will check your availability. The screen says whether it can also write. If they cannot paste the permission line, we do not connect it. We paste the free hours. An agent that can invite will invite the moment the task says hold, book, or tell them we’re on. You will hear about it from the guest. Read-only, verified on the account page, is the only connection that matches “only read your day.” Everything else is an invitation tool with a calendar icon.

So: a calendar connection lets the agent invite other people unless you have confirmed it cannot change events. Only a view or free/busy grant is a read. If that confirmation is missing, it is not connected. Your day can be a sentence you typed. It does not have to be an account.