where do you draw the line on what you let an agent log into

I keep running into the same wall building agents that touch real accounts. The moment a login or oauth token lives somewhere other than where the human usually works, the agent needs its own copy of the session, and now there are two things that can leak instead of one. My actual rule right now: anything read-only or low-stakes, the agent gets standing access and just goes. Anything that sends, spends, deletes or publishes stops and asks first, every single time, even if it asked five minutes ago for a similar action. Per-app access has turned out not to be the same thing as per-action access, the first one just tells you which app got compromised. Curious where other people land on this, especially past a few dozen agents running at once. Do you let any of them hold a standing write credential, or does everything funnel through a human click no matter how repetitive it gets?