My agent kept reading data it wasn't allowed to. The prompt was never going to stop it.

An autonomous agent running in its own environment has to talk to real services, and real services want credentials. In our case there were three of them, all third-party: a CRM, an automations engine