How Do You Restrict an AI Agent to One Workflow With Microsoft Entra, ServiceNow AI Passport or SailPoint?
Give the agent its own identity and only the apps the workflow needs, then add what none of the three documents: tokens for out-of-task values on screen.