least privilege

Borrowing the creator's full access is the default that causes incidents. Give unattended agents their own identity with narrow scopes, an owner and an expiry, and keep delegation for interactive work.

Every connected server is code you did not write, holding credentials you issued, describing tools your agent will trust. Write the approval checklist and the runtime controls.