Every tool call runs as the signed-in user, so the RLS you already wrote decides what each agent reaches.