Don't developers configure their LLM tools to only be able to access things the user using the LLM should have access to?