Great thread. Whatever an AI agent is capable of doing, it can also be tricked into doing. You should assume if an agent can access data, that a user can eventually get that data too. Agent security, access controls, and deterministic guard rails will be critical.