The egress filtering + DLP layer is interesting — most agent projects skip that entirely. Signed skills is the right call too. Curious how the Cedar-inspired policy engine handles ambiguous cases — where the action is technically within policy but the context makes it risky. That seems like the hard part with any agent authorization system. Nice work shipping this.