The rules governing which tools an agent may call and which need confirmation — the boundary between a mistake and an incident.
An agent is exactly as dangerous as the tools it can reach. Read access to a repository is nearly harmless; shell access with production credentials is not, and the model cannot reliably tell you which category it is currently operating in.
The pattern that holds up is allowlisting rather than blocklisting, plus confirmation on the irreversible. It also matters more once prompt injection is in play: a hijacked agent inherits whatever permissions you granted, so the permission set is the real blast radius, not the model's judgment.