See how Vault gives an AI agent a trusted identity, lets it act on behalf of a user, limits its blast radius with ceiling policies, and scopes a single action with Rich Authorization Requests.