Agents

One scoped key per agent: kill switch, expiry, rate limits and credit caps. Access requests land on the agent that asked.