Production teams keep learning the same lesson: capability without access control becomes a privacy incident. Minimum bar is least privilege for tool calls, durable logs of what data was touched, and a human-readable trail when something looks wrong. An offline design makes the data boundary clearer. How are you scoping what an agent can read from customer systems? iin1004h1328