Know which agent called you.
Give each agent a verifiable identity with an owner behind it. Your API can tell who sent the call and who it acts for.
Agent identity is a reusable, verifiable record of which agent is acting, who owns it, and which runtime it acts through.
Verify the agent before the call
agent-gate.ts

Give every agent a name you can check.
Give each agent a verifiable identity and check it before the call runs.