Govern natively, federate outward, and what breaks across trust domains

This post extends the agentic AI governance capability by detailing the strategy for federating trust outward to existing identity providers and workload identity systems, rather than attempting to converge them. It emphasizes the authorization server as the control plane for agent identity and externalizing fine-grained authorization into a policy layer. It also introduces the concept of scaling controls with an agent's blast radius and highlights the unsolved problem of cross-trust-domain interactions.