Your breakdown of the authentication piece is exactly right. The multi-service local environment setup, logging in as a user, recording the session, keeping credentials safe across runs, that's the kind of friction that sinks general-purpose agents but never shows up in demos. You solved it by narrowing scope to one pipeline. The other direction is giving the agent its own identity layer, so it carries credentials and session state as part of its runtime rather than wiring them in fresh each time. A programmable wallet and credential vault let the agent authenticate to any service without secrets in prompts or files. That kind of portable identity feels like the right direction for making agents that can truly own a ticket end to end.