Agent security is operational, not theoretical. It comes down to four runtime questions: who is the agent, what can it call, who approves, and what credentials does it get. A security team that can answer those four questions in writing has a defensible posture.