A new clinician at a hospital does not get access to every patient record on day one. They get access scoped to their role, oversight from a supervisor, and a record of what they touched. Most health systems deploying AI agents against clinical systems skip all three.