What steps are needed to migrate an existing agent system to use Catalyst’s workload identity and tool authorization?

First, register each agent runner with Catalyst and assign a workload identity (e.g., via SPIFFE-compatible certificates). Second, define tool authorization policies that map each identity to allowed MCP tools. Third, update your agent framework’s tool-calling code to route through Catalyst’s policy enforcement API. Finally, test in a staging environment with simulated prompt injections to validate containment. No changes to your agent framework logic are required.