A customer-support agent is deployed with tools for issuing refunds, deleting user accounts, and writing directly to the production database, but its actual job is only to read order status and update support tickets. According to the principle of least privilege, what is the BEST remediation?