Contained by design: tenants are isolated so one compromise does not cascade, tokens are scoped and revocable, agents are capped by hard limits, and receipts plus the Ledger make reconstruction fast instead of forensic archaeology.
Serious security thinking starts from 'assume something eventually fails' and engineers the failure to be small, visible, and recoverable. That is the same philosophy as Heidi's agent design, applied to the platform itself.
Your own levers matter too: scope API tokens narrowly, keep agent caps meaningful, and treat approvals as real decisions. The system is built so the cautious defaults are also the easy ones.