>>nico+(OP)
I imagine your best bet are exactly the same tools for a potentially-malicious human user: Separate user account, file permissions, database user permissions, etc.
>>Terr_+k5
This is probably the safest thing to do, also the most time consuming
It would be nice to just be able to solve it through instructions to the agent, instead of having to apply all the other things for each application/server/database that I'd like to give it access to