Wow, thanks for writing this up.

I'm building an agent sandboxing system for a client atm, and was about to start working on a system of ephemeral, short lived, derived secrets for the agent to use.

Lots of great thoughts to steal in this piece. Thanks again.