Credential scoping handles the "what can the agent do" part, but after running a few agents on my own data for a while I think the harder problem is what they can see. Prompts turned out to be pretty much useless as a boundary there, so I ended up pushing all of it server-side. Is unyolo doing anything on the read side, or is it strictly about gating actions?