The Least Privilege Configuration

Design a least-privilege configuration for this agent.

Agent purpose: [DESCRIBE]
Currently available: [LIST TOOLS AND PERMISSIONS]
Systems reachable: [LIST]

Produce:
1. The minimum permission set that lets the agent do its job
2. Everything currently granted that is not required
3. Permissions that should be conditional — granted only in certain
   contexts
4. Read vs write separation: can a read-only version of this agent
   exist, and would it be useful?
5. Scoping: per-user, per-tenant, per-resource limits
6. Credential handling: what the agent's execution context can see,
   and what must be injected outside it
7. What the agent should be told about its own limits
8. What happens on a permission denial

Then address:
9. Impersonation: when the agent acts on behalf of a user, does it
   act with the user's permissions or its own? What are the
   implications?
10. Escalation: is there any path by which the agent could reach
    something its caller could not reach directly?

Question 10 is the important one. Answer it specifically.