Least privilege for intelligent agents

One scope per tool

Do not hand the agent a key to the whole system. Every tool should carry its own scope, and every scope should be revocable.

Human approval for high-risk actions

Deleting data, moving money and changing configuration belong in an approval queue, however confident the model sounds.

Complete, immutable logging

Every tool call, its input and its result should be recorded. Without that, incident review is impossible.