I turned on Windows 11's AI agents, then immediately revoked their file access

Scoped access beats standing access, every single time