running headless agents in the background gets dangerous without execution boundaries.
a worker inherits ambient admin capabilities, mutates state mid-run without an audit trail, and leaves downstream jobs running against corrupted records.
scoping permissions per-task and forcing atomic write leases is the only way to let background agents run unattended.