Hang on a second. You think accessing private information in a public channel is a good idea?

If a tool is authenticated as personal then it can be only accessed under personal context - i.e. privately. Now if the author of the agent wants to add tools authenticated with shared secrets that is something should be considered in the threat model.

In other words:

- reading my personal emails in a public setting - not ok - reading the agents shared inbox in a public setting - probably ok depending on the threat model

> not ok - reading the agents shared inbox in a public setting - probably ok depending on the threat model

This is never secure. Some SAAS apps have automatic enrollment into company/teams based on email domain. So you can sign up with the email address of the agent and then ask for any 2fa code or other emails.