An agent becomes genuinely useful when it can access data and trigger actions. That is also when permissions become an essential product capability.
Limit tools to the current context
Each tool exposes one precise action, validated parameters and the permissions of the current user. The agent never receives broader access than the person it assists.
Confirm before acting
Sensitive operations require explicit confirmation. Traces preserve the intent, parameters and result so that errors can be understood and evaluations improved.