Agents that do work for your customers inside your product — scoped to the account, the role, and the permission set, not bolted on as a sidebar chat box.
B2B agents act on customer data inside multi-tenant systems. The hard part was never the model — it's that every retrieval and every tool call has to carry an account boundary with it, and a leak across that boundary is a breach, not a bug.
Tenant isolation belongs in the permission and retrieval layer, not in the prompt. A model instructed to respect boundaries is a model that will eventually cross one.