Sponsored
Most agents run on borrowed sessions. The user authenticates, the agent inherits their full OAuth token, and a support agent that looks up invoices can also refund, delete, and modify. The agent needed read access to one record. The blast radius is every account in the system.