How much access should an AI agent have?

I keep running into this question when thinking about agents connected to real tools. A workflow might start with read-only database access. Then it needs an API, email, or an MCP tool to finish the job. Each addition s…