Agent security

Bank-grade controls for machine spend.

• Hash-only API secrets; shown once
• Least-privilege scopes (no wildcard on create)
• Policy engine before every Privy call
• Session signer required; no raw private keys to agents
• Idempotency + x402 nonce replay protection (KV)
• Rate limits (AGENT_RATE_LIMITER)
• SSRF-safe webhook URLs
• Per-agent pause/revoke + global AGENTS_ENABLED
• Append-only audit log