How are you actually securing your AI agents right now?

We're launching AxioRank tomorrow (the security gateway for AI agents), and before

we do I'm curious how this community is handling it today.

• If you have agents calling tools, APIs, or databases: are they on static keys or

  short-lived identity?
  
  Do you enforce a policy on what they can do, or mostly log it

  after the fact?
  
  And could you prove to an auditor what an agent was allowed to do?
  

  Genuinely want to hear what's working and what isn't.