Reviews agent and MCP surfaces, tests prompt-injection and runtime controls, and maps identity and authority across agent handoffs.