What the agent can reach
Also called Blast radius of an agent, Agent trust boundary
Everything the agent could touch if it wanted to, or if someone tricked it: your files, your environment variables, your logins, your network. That reach, and not the task you gave it, is the size of what could go wrong.
Anything it reads can contain instructions, and a model can't reliably tell your words from an attacker's. So you judge a setup by its reach. If private data, outside content and a way to send data out are all in one agent, you have a problem whatever the task is.
Say it to your agent
“List everything you can reach from here: environment variable names, which credential files exist, which MCP tools you have, and which hosts you can connect to. Print names only, never values.”