The thing I didn't say explicitly in the post: most people's instinct is to connect the agent to everything first and worry about trust later. I did that too. The discomfort was the signal.