Do not give an agent the same publish token you would give a trusted coworker. Give it a draft slot, a human gate, a daily cap, and a kill switch. The Buffer, Hootsuite, and Planable MCP patterns already show how that split looks in production software.
Start draft-only. Planable forces AI posts into the approval chain. Buffer lands Claude output in the queue for review. Hootsuite’s Perch connector can publish if you let it — so do not start there. Connect MCP with the narrowest role the product offers. If the vendor exposes an approve tool, keep it off until the copy is boringly good.
Second, split brand and personal. A personal Bluesky and a company LinkedIn should not share one OAuth grant. Use separate Buffer channels or Planable workspaces. A prompt-injection on a public page should not be able to speak as the brand.
Third, cap the blast radius: a daily post limit, no replies from Nest until a human has seen the tone, no auto-approve. Write the kill switch before the first draft goes out: revoke the MCP connector, rotate the Buffer API key, disable the Hootsuite connector. One person should be able to do that in under a minute.
The test is simple. If the agent can put words on a network without a person clicking, you have given it a raw publish button. Pull that permission back. Draft, review, cap, split, kill — then let it write. The connectors above are useful only when those five controls sit in front of them.
