I'm building the agentic runtime and agents running on this platform. The keystone of agentic work is "allowlists vs denylists" choice. On my platform I use allowlists for everything (tools, MCPs, skills, memories etc.). Agents work in a sandbox and have only allowed resources they need for functioning. Nothing more. The LLM is a probabilistic by nature, it can try to access or delete the resource without a reason, it may follow the prompt injection, it may leak the secret or private data. So all this should be controlled by the agentic runtime. In my system I use specialized agents as team players - each agent does it's part of work using available resources. This way you can keep all needed data in the model's context window without compaction and optimize resources control. Ask more specific question if you need a detailed answer.