Agent infrastructure is four bolted-on layers. None of them enforce.

Libraries request. Runtimes enforce. The agent stack skipped that layer entirely.