It's going to be very tempting to give tool access to these agents because that is the main way they become useful, but the security model of that is challenging. Every day users will have a hard time understanding the security risk of decisions.