An AI agent should not become more powerful than the person using it. Yet connecting agents to enterprise data can create authorization gaps when identity, permissions, retrieval, and downstream actions cross services. This session examines how to design secure agent experiences in Microsoft Fabric while preserving existing governance controls. We will follow a request from user authentication through OneLake and semantic-model access, data retrieval, agent reasoning, and tool or action execution, identifying where authorization context can be lost or broadened. We will cover least-privilege design, row- and column-level controls, governed semantic access, Purview integration, agent data boundaries, and approval gates. Attendees will leave with a security checklist and reference flow for building useful Fabric agents without bypassing enterprise permissions and accountability.