Each session starts its own isolated agent. Approve what it can reach.