Agent permissions should be opened up progressively: the first level allows reading data but not writing to business systems; the second level allows proposals that require human approval; the third level allows entry into ERP/MES/CRM to place orders and change schedules after human approval; and only the fourth level grants autonomous execution within a defined scope, with monetary limits, whitelists, logs, rollback capabilities, and human takeover in place.