Thank you to everyone for all the helpful advice here. I have been able to get a Dialogflow CX Data Store Agent working. However, when users click the cited document, they get a 403 Forbidden. The documents are in Cloud Storage buckets and are not publicly available.
The users have access to Cloud Storage in IAM, and I even added a custom Cloud Storage read scope to the OAuth. It seems like one answer might be using webhooks to create signed URLs? Are there any other ways to make private documents available to users in Dialogflow CX?