Risk-based authentication checks sensitive actions as they happen, while narrow permissions limit what AI agents can do on a user's behalf.