Every agent has a cryptographic identity and a defined set of capabilities.
Before an agent acts, the runtime verifies who it is and what it is permitted to do. Capabilities are scoped to the workflow. Actions are logged with cryptographic provenance. Nothing happens off-policy.