Where to draw the line on what an agent may log into
A practical thread on the access boundary for agents that touch real accounts: the moment a login or OAuth token lives somewhere other than the human's own workspace, every agent tool wants its own copy of the session. Suggested posture: read-only scopes, separate sandbox accounts for writes, credentials in a vault the agent references but never sees.