One tunnel for every agent · observed, governed, controlled
One address and one credential for every agent your teams run. Each call is checked before it leaves, counted, and held for a person when a rule says so.