It feels too risky to let this server run autonomously on production clusters even when ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS=true since the agent can still create / modify resources, perform helm operations etc.

Yet, being able to run autonomously but in read only mode would still be useful e.g. for incident assistant / investigator.