Context variables versus data access control
Key Takeaway
A context variable such as MessagingSession.ContactId is a name tag, not a key. The user the agent runs as decides what data it can reach.
Every Agentforce agent runs its actions as a specific Salesforce user, and that user's access decides what data the agent can read and change. Context variables are a separate thing. They tell the agent who the customer is, but they don't limit which records the agent can reach. So when a Service agent runs as its dedicated agent user, you need to build that limit in yourself.
Execution context: the user an agent runs as
The user an agent runs as is its execution context. That user's profile, permissions, field-level security, and sharing rules govern the agent's data access. Which user the agent runs as depends on the agent type, the channel, and whether credential-based user verification is enabled.