Your agent can read Slack. It can search email. It can query the CRM, open GitHub issues, check billing, browse docs, edit a spreadsheet, draft a customer reply, and call three internal APIs.
Everyone in the room calls it powerful. That is the first mistake.
The question is not what the agent can access. The question is what it is allowed to change. Can it send the email, or only draft it? Can it update the customer's plan, or only propose the update? Can it merge the pull request, or only open it?
Once an agent can act through tools, the real system is no longer the model. The real system is the action contract around the model.
Access is reach. Agency is permissioned action under constraints.
