Agents submit intent; they do not hold execution rights.
The airlock: an agent passes structured intent through an internal RPC stub to a deterministic control plane, with no direct path to the outside world.