Exactly. This is how I design agents as well. I essentially treat the agent as the web/mobile app, cli tool os API library not as part of my backend even though there is where it runs. The backend doesn't treat the agent in any special way. It simply gates all action based on the permissions of the user/guest that is using the agent.