CS tools should require some 2FA based on personal information. CS agents should not be able to access arbitrary data.