Every tool you hand it is a door.

On the call, we would ask

• Which systems would the agent need to read, and which would it need to change?
• Whose login would it use?
• What is the worst thing it could do with that access on a bad day?
• Can each tool be switched off on its own?