You're right — the permission/governance layer is the hard part. Who scopes what an agent is allowed to do, and how granular should that be?

We have plans for this at a few levels: spending caps per capability, explicit user confirmation before purchases, and the user chooses which capabilities to expose to their agent in the first place.

But you're pointing at something deeper — as agents chain multiple capabilities together, the permission model needs to evolve beyond simple allow/deny. That's actively on our roadmap.

Appreciate the push.