Is it safe to point autonomous agents at Heidi's API?
Yes, that is the design case. Scoped tokens limit what an agent can reach, side-effecting tools are refused outside the confirmation path, rate limits are per scope, and everything the agent does is logged with attribution.
The blunt version from the docs: your intern's experiment cannot page your customers. A default token reads and asks; acting requires wider scopes an admin grants deliberately.
Prompt-injection resilience is why the boundary lives server-side: whatever a hijacked client asks for, the surface refuses what the token does not allow.