When you wire an integration into an actor’s Capabilities, expose only the specific actions it needs, like just send-email, rather than a whole app’s action list. Give an actor “all of Gmail” and it may call delete-thread when a user says “delete this conversation.”