Kernel

Before your agent touches money, data or production, one in-process Kernel decides what runs, verifies the intent behind it, and encrypts the data the agent shouldn't see.