How do you safely let an in-product AI agent take actions for users?