Bounding the agent by the permissions of whoever connected it is a sensible default. Can it get less than that, say one board in read-only, so a teammate can let Claude groom the backlog without it touching the roadmap?