Least-privilege & approved-API whitelisting

Defining what an agent physically can and cannot do: whitelisting approved APIs and
enforcing least-privilege access so that even a hijacked agent has a small blast
radius. Students apply the principle introduced in EB-4's network-policy material.