Agentforce agent access is the org security control that decides which people can use a given agent and whose permissions the agent uses when it reads or changes Salesforce data. Employee agents run as the logged-in user and are granted to people through permission sets or profiles, so the agent can only do what that employee can already do. Service and Lead Nurturing agents typically run as a dedicated agent user so they can work in channels that are not limited to logged-in people, which means you must lock down that user and verify customers before private actions run.