Can an AI agent do anything a person cannot?

No. An agent connects with a person's API key (or a service account's) and acts with exactly those permissions, through the same services as the web app. Everything it does is recorded under that person and marked as done by an agent. See Working with AI agents.