Set your agents loose.
Bound the blast radius.

Connect your accounts once. Grant each agent the capabilities it needs, with the parameters pinned. The gateway refuses everything else.