Least Privilege

The key move is to enforce the limit in the platform, not the prompt. A system prompt that says do not delete records is a request; an API token without the delete scope is a control. Assume instructions will eventually be ignored or manipulated.

In a revenue stack this means scoped OAuth scopes, object- and field-level security on the agent's identity, and separate read and write paths, so the agent can do its job and nothing beyond it.