An agent working a task does not receive a standing API key. It receives exactly the tools, resources, and prompts that task is allowed to use, and every call, allowed or denied, is written to an audit trail.
Pick a task under Task Scope, then call tools from the Console to see the boundary enforced live.