Apps are going headless. The UI used to be where users expressed constraints: approve this, deny that, set this limit, revoke that access. But agents do not live in UIs. They call APIs. So the control layer has to move from buttons to policies.
Who is solving this?