Agents should have the same permissions as the user prompting them, nothing else.
No rules will stop agents of accessing data or modifying content if the agent have permissions to do it.
That does not make the agent "safe" from the perspective that it still can and eventually will cause havoc, delete critical data, etc. But it makes the system safe as it isolates that user access and it is not worse that having an unruly/malicious user.
