Yes, actually I have found a solution; at least it works for me. The idea is laid out in detail here: blog.iluxav.com/the-attack-was-authorized-the-mis…

TLDR; User vendor access key with its scopes belongs to the actual user and is hidden from AI agents. Instead, there are cryptographically derived keys that can only narrow down the permissions and ONLY with the user's explicit consent for a short period of time. The approval flow works via OpenAI elicitation protocol that pops the consent in the chat, or it could be done externally via Slack, Teams, emails - whatever