AI agent workflows, with two layers of permissions