Tools built from your permissions
A table you cannot read is not listed as a tool. It is not refused when called — it is not there, because a refusal that names what it protects is not a refusal.
For agents
A credential can never do more than the person who made it
That sentence is the whole design. An API key made by someone in Sales sees what Sales sees. There is no service account with a view of everything, because there is nowhere for one to live.
The agent proposes, you apply
Every write an agent makes is a changeset: what would change, in rows, before it happens. Applied changes stay revertible afterwards, and reverting a revert is just undo again.
Built for the token budget, not against it
Lists return a bounded page and tell the model to narrow rather than handing it a cursor to walk. Large files go by signed URL, so writing a component does not mean writing every token of it twice.