How much access should an AI agent have?
A builder asks where to draw the line as agents graduate from read-only database access to email, APIs and MCP tools, each step reasonable on its own until the agent can read sensitive data or contact people. The poster's key point is that a system prompt is not a security boundary: if the credential allows an action, the agent will eventually take it, so least-privilege credentials and human approval gates matter more than instructions.