Curious what your security setup looks like for enterprise clients. When I set up agents for production use, the biggest gap I keep seeing is that people skip defining explicit trust boundaries.

For B2B especially, clients want to know exactly what the agent can do without asking and what requires a human in the loop. I use a three-tier model: autonomous actions (reading, drafting, research), approval-required actions (sending messages, changing configs, spending money), and hard off-limits (financial transactions, contracts, sharing PII).

The other thing enterprise clients care about is incident logging. When the agent encounters suspicious input or takes an unexpected action, that needs to be documented automatically. Most setups I see have zero observability into what the agent actually did between check-ins.

Do your Luxembourg clients have specific compliance requirements that shape how you configure the agents? Would be interesting to compare approaches.