Where this falls down is that for the agents to interact with anything external, you have to give them keys. Without a proxy handling real keys between your agent and external services, those keys are at risk of compromise.

Also. Agents are very good at hacking “security penetration testing”, so “separate user” would not give me enough confidence against malicious context.