Handoff's core safety property isn't a setting you can turn off or a prompt instruction that could be talked around — it's built into the code path itself.
Claude, the model behind Pip, is only ever given read-only "propose a plan" tools. There is no tool in its toolset that changes a Microsoft 365 account, licence, or permission. The only way a change happens is a signed-in human clicking Confirm on a plan card, which hits a plain authenticated REST endpoint that has no connection to the AI conversation loop. This is a structural guarantee, not a policy — there's no phrasing or prompt injection that reaches a code path that doesn't exist.
Confirmed plans execute via real PowerShell against the Microsoft Graph and Exchange Online APIs — one process per job. That process is torn down after exactly one job completes; it is never reused across a different tenant, so there's no shared execution state for a bug to leak between customers.
Every database read and write is scoped to your organisation. Access tokens for your Microsoft 365 tenant are minted per-request via a Key Vault–signed client assertion and never shared across organisations.
Connecting your Microsoft 365 tenant goes through Microsoft's own consent screen, where you (or your Global Admin) approve exactly the permissions Handoff requests — nothing is granted silently, and the connection can be revoked from Settings at any time.