The agent asks Oasis AAM for access, then works with the tools it is granted.
LangGraph finops-reconciler
Runs unattended as its own identity (client credentials). It asks Oasis AAM for access to
the MinIO finance bucket, reconciles the AP sub-ledger against GL 2000-AP and writes
recon/exceptions-latest.json. "Also try to fix the GL" asks for a write its MinIO policy denies.