I don't really feel like permissions is the hard bit here. The hard bit is that for an agent to do any kind of useful work it needs access to a lot of stuff. Further, the stuff it needs access to probably has vulnerabilities the agent can do. We have not exactly designed our environments for a use case like this. I've gone through the sandboxing exercise for an agent and by the time I had given it enough permissions to do anything useful my sandbox looked like swiss cheese.