What architecture does Catalyst use to isolate agent identities and limit tool misuse in production?

Catalyst assigns each agent runner a unique workload identity, separate from the underlying infrastructure identity. Tool authorization policies map which agent identity may call which MCP tools. This identity-per-agent architecture ensures that a compromised agent cannot access tools belonging to another agent. All tool invocations pass through Catalyst’s policy enforcement point, which logs and audits each call, providing a verifiable trail for incident response.