Yeah, many of these seem solvable with access tokens and permissions systems.

I think it's wolves by treating the LLMs assistants to the user, who should have no more permissions than himself. Not as a process system with permissions to do anything an admin does.