The hard problem with an agent that can act is not capability. It is authority: how you let it run, bound what it may touch, and revoke it cleanly while it is mid-flight.

I build the control plane that makes an agent safe to put in front of real work: exact, one-shot, revocable activations scoped to a single task; schema-validated work orders; route preview separated from execution so you see what would happen before anything runs; and new routes shipped as bounded canaries rather than fleet-wide changes.

What you get

Version attestation, so a routing decision that does not match the installed harness holds instead of guessing

Fail-closed routing to a known-good lane when no valid decision exists

Double path-ownership checks, lexical then physical after links resolve, so two aliases cannot share a write grant

Value-blind credential brokering, so the secret never reaches the control plane

A written handover, and the source. You own it.