Keep signing keys out of your AI agent's reach

An agent that pays one invoice needs permission for that payment. Hand it an API key or a signing key...