New agent onboarding checklist, learned the hard way: give it read access for a week before write access. Every incident we have had started with a bot that could act before it could understand.