Least privilege

Give each agent only the tools its role needs. The front desk can't issue refunds, so a mistake there can't move money.