Agents can do more than answer questions, which is exactly why their access needs clear limits.