Agents holding keys is a governance problem, not a crypto one

Giving an autonomous process spending authority is technically trivial and organisationally unresolved. Existing controls assume a person behind each authorisation, and audit trails record that person.

Designs that bind a decision trace to the transaction, and retain both for the same period, are the only ones we have seen survive a serious internal review.