Right, you have to set boundaries. You put each task and user input into a box, and then the LLM makes a decision. It can only access APIs that have user identity attached, that act within the scope of the requesting user.

It can be done, but unsurprisingly it looks exactly like microservices distributed auth (also ZTP).

It's all the same problem, just instead of a JVM, it's an LLM.