Agentic framework 2.1.2: define least-privilege limits giving each agent only the tools and data it needs, using functional boundaries; constrain autonomy with standard operating procedures the agent must follow; design ways to take agents offline and contain their impact, such as self-contained environments for code execution; prefer deterministic limits enforced by access control over prompt instructions, and add monitoring or human review where limits are less reliable; then evaluate whether the residual risk is tolerable.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.