Reading from a CRM is a data problem. Writing to one is an organisational problem.
Give the agent its own identity
The agent gets a service account with its own scopes, never a borrowed human login. That single decision makes every later question answerable: what the agent can see, what it changed, and how to revoke it in one step.
Scope it to the objects the process needs. An agent that drafts follow-ups does not need permission to delete opportunities.
Make every write reversible
We separate actions into three tiers. Reads happen freely. Writes that create a draft or a note happen automatically and can be undone. Writes that change a stage, a price or a customer-visible field require a human approval step, at least until the test set says otherwise.
Every write carries a marker identifying the agent and the run that produced it. When somebody asks why a field changed last Tuesday, the answer takes seconds.
Expect the integration to be the slow part
Teams budget time for the model and none for the plumbing. In practice, permissions, field mapping, sandbox access and the approval workflow take longer than the agent logic.
Plan for that, and the launch stops being a surprise.