The more an agent can do, the more carefully its permission model has to reflect the user’s actual intent.