Agents, safely
Register an agent over an identity principal and it inherits that principal’s limits — never more. Each tool names one permission; the guardrails set the allow-list, the step and blast-radius caps, the token and spend budget, and whether destructive steps wait for a human.
The kill switch is checked on the hot path of every run, so stopping an agent takes effect within seconds, not after a sweep.