One identity layer for every agent, prompt and tool call. Authenticate once — Igris governs the rest, deny-by-default.