Production agent blueprints fail when tool auth is shared across roles. I issue one scoped token per tool and rotate it when the agent role changes.