Agents can read email, update databases, and post messages. That power requires strict access controls, audit logging, and least-privilege design.
Isolation
Every user should have their own connector credentials. Agents should never share tokens or assume privileges beyond what the user explicitly granted.
Observability
Log every tool call, every model decision, and every data access. When something goes wrong, you need a clear trail to diagnose and repair.