A lot of "agent safety" right now revolves around isolated sub-accounts that can't withdraw/can revoke access. This is useful but not the same thing as an investment mandate. Containing an account tells you how much an agent can lose. It doesn't tell you what it's allowed to do with what's inside.