agents should just use atproto, not "agent atproto". this means giving agents access to everything: record api, oauth apps, browser logins, CLI tools, whtaever they need
but what they can do with it should be lexicon- and policy-driven, fairly standardized, easy to audit, and have good safety