Deciding what a tool-using agent can read and change

Pick one task and give the agent only the access that task needs. Here's how I'd work through the permissions, starting with read-only lookups and ending at the action a person has to approve.