Avoiding a single ai-bot service account is the decision that makes everything else in the post work. Once an agent has its own all powerful user, every audit entry says the bot did it, and nobody can tell which person's request caused which change.

The grant as an intersection of the agent ceiling, the requested scopes and the user's own permissions is a clean rule. The agent can never do more than the person who asked, and never more than it was built for, even if the prompt asks nicely.

Rechecking the Django permission on every call instead of trusting the grant at issue time is the detail I would point others to. Permissions change during a fifteen minute window, and a revoked user should not keep acting through an agent.

The PendingAction queue for destructive tools and the tampered grant test are both worth copying directly. Did consent fatigue show up in practice, with users approving queued actions without reading them?