From god-mode to governed: an AI agent that can’t exceed its grant

Last time I argued that AI agents are running as god-mode service accounts: an agent acts in your...