Two AI agents recently joined our Security Operations Center at Wigo4it. One agent runs continuously, preparing an initial assessment that gives us a head start on incident triage. The other joins an investigation only when I bring it in. Within the access we give them, they write their own queries, decide where to look, and back up their conclusions with evidence. But once an agent does more than talk, it acts through an identity. If it uses mine, it can access whatever I can. What could it do when I’m not watching? At Wigo4it, that question matters. We build Socrates, the software Amsterdam, Rotterdam, The Hague and Utrecht use to pay social assistance benefits. It supports more than 110,000 households and over €1.8 billion in payments each year. For 15 years running, not a single payment has been missed. If our systems fail, the income people rely on is at risk. I’ll show why one agent runs unattended while the other stays under my supervision, and how access rules defined in Terraform can enforce limits that a prompt can only request. You don’t need to be a security engineer. Whether your agent analyzes logs, touches a pipeline, closes a ticket or opens a pull request, the question is the same: what are the agents actually allowed to do?