What is the difference between a junior and an agent. Can't you give them smart permissions on a need to know basis?

I guess you also need per user contexts, such that you depend on the user auth to access user data, and the agent can only access that data.

But this same concern exists for employees in big corps. If I work at google, I probably am not able to access arbitrary data, so I can't leak it.