Agent security guides

Keep credentials, transcripts, private assets, and autonomous render permissions inside a deliberate boundary.