Issue scoped Bearer tokens to restrict which actions an AI agent can execute.
Tokens carry granular allow/block rules evaluated on every request.