Give the agent a cryptographic identity — and never let it know what that identity actually is. Think of it the way you'd run an informant, or a defected spy: it operates under a cover to do the work, but it never holds the real keys — those stay with its handler, locked in a hardware vault. The agent carries the cover. The handler carries the keyring.

A rogue agent isn't hunted down. It's simply handed back to the silo it came from — and the market quietly stops answering. Revoke one credential, and every compliant gateway, everywhere, declines to deal with that identity. No chase. No drama. Just gravity.

And if something does go wrong, a human can reach in — at exactly the scope the moment calls for, no more and no less. Three severity levels, hierarchically scoped: pause one agent, one domain, or — in the gravest case — the network itself. A circuit breaker sized to the danger, not a sledgehammer.

Which raises the obvious question: couldn't a sufficiently capable AI just… break the encryption? It's the right question to ask of any system that puts cryptography at its center — and the honest answer has two halves that pull in opposite directions.

Half one: no. Not “difficult” — thermodynamically impossible. Brute-forcing AES-256 would cost more energy than exists in the observable universe. Flipping a single bit has a minimum energy cost — Landauer's limit. Counting through 2^256 possible keys at that floor would outspend every star that will ever burn. The lock was never the weak point.