Limiting What AI Agents Are Allowed to Do