Aggrete addresses the gap that RBAC never could. Resource-level access control and cross-resource aggregation are different problems, and no gateway on the market handles the second one.

There is another angle here. If the assistant authenticates with its own identity instead of inheriting the user's full permission set, the aggregation problem becomes harder to trigger. Each task chain starts clean with short-lived credentials. The assistant never had the broad scope, so it cannot accumulate a dangerous combination across sessions.

This does not replace what Aggrete does. Some tasks genuinely need access to multiple systems, and aggregation detection is the right tool for those. But identity separation changes the default from "the assistant can see everything I can see" to "the assistant can see what this task requires."