Notes your agent can read and cannot change
Letting an agent write in your notes raises one fear before any other. It will rewrite the page you cared about most, confidently, while you were looking at something else.
Protect the bullet and set it to refuse agents only: every connected agent is then refused a change to it and to everything under it, and you can still edit it yourself.
Set it up
- Point the client at https://pando.ink/mcp, which speaks streamable HTTP.
- Authenticate with OAuth 2.1 and dynamic client registration, or paste a key from Agents and API keys as a Bearer token.
Two presses in the app
- Open the bullet’s menu and choose Protect it from changes, or press Ctrl+Shift+L at a desk (Cmd+Shift+L on a Mac). Nothing can now change or delete it or anything under it, you included.
- Open the menu again, choose How it is protected, and under Refuses pick Agents only. You can type in it again. Anything that arrives with a key cannot.
Which agents it refuses
All of them. A connector you approved in Claude, ChatGPT or Codex holds a key of its own, exactly like a key you pasted into a terminal, so one lock refuses every one of them in the same place. The server decides by how a write arrives, not by anything the write says about itself, so an agent cannot pass itself off as you.
An agent may lock, and may not unlock
An agent is allowed to protect a bullet. It is refused when it tries to take a lock off. That is the right way round: removing a guard is the expensive direction, so that one stays with you.
A form the agent fills in and cannot redesign
Under Reaches, choose Its shape only. Nothing inside can then be added, moved or deleted, and the words on each line inside can still be written. That is a template: a weekly review or a report with fixed headings, where the agent writes the answers and the structure holds.
The agent knows before it tries
The tree tool marks protected bullets, so an agent reading a branch sees the lock and plans around it. If it writes anyway, the refusal names the bullet that holds the lock, which is enough for it to tell you what it could not do instead of guessing.
What a lock does not do
It hides nothing. A protected bullet is still read by every agent that reaches it. The lock decides what may change, not what may be seen, and a page that told you otherwise would be selling you the wrong guarantee.
What it costs
Nothing. Protection is in the free plan with every other feature, and no payment card is asked for.
Deeper
Connect an agent, about two minutes · The twelve tools · Which note apps an agent can reach · Who runs this