An agent should hold the narrowest credentials that let it finish the task, scoped per run where possible. Broad standing credentials turn every prompt injection into a full compromise, because the model has no reliable way to refuse an instruction it cannot distinguish from yours.