"policy engine the model can't tamper with" sounds nice until you remember the model isn't the only thing in the loop, the host and transport are where the real mess lives. Per-message HMACs and nonce/timestamp binding are not some new authorization story, they're just basic message authentication with a fresh wrapper, and they do nothing for replay at the boundary conditions people always hand-wave past. If the point is to keep the agent from inventing privileges, fine, but that was never the hard part. The hard part is making identity and policy survive the glue code, retries, tool calls, and partial failures without turning the whole thing into security theater.