Comment by sleda

A grant limited to one selected file, with read and write access scoped separately and an expiry, would avoid giving the agent the whole Drive.