A records-request agent acting on behalf of a specific resident must only surface documents that resident is personally entitled to see, not everything the agent's own service account can technically reach. What design ensures this?

Identity propagation carries the requesting resident's own access scope through Agent Gateway and Agent Registry into the agent's execution, so the enforcement point checks what that specific resident is entitled to see rather than what the agent's underlying service account can technically reach. That's the structurally correct fix because it ties access to the actual party the request is on behalf of, request by request. Trusting system instructions to remind the model to respect entitlement is a request made to a language model's behavior, not an enforced boundary, and it can be bypassed by an edge case, a bug, or a crafted input the instructions didn't anticipate. Narrowing the agent's own service account permissions so far that it can never reach restricted records defeats the agent's purpose entirely, since it would then also be unable to serve residents who are legitimately entitled to those same records. Filtering response text for document titles that look restricted is a fragile, after-the-fact pattern match operating on the output rather than the access decision, and it will both miss real restricted content that doesn't match the pattern and mistakenly block legitimate content that does. A scope caveat: identity propagation only works if the resident's identity is reliably established at the start of the interaction, so weak authentication upstream undermines the whole chain. As an operational check, an architect can have two different residents submit the same request and confirm each sees only documents scoped to their own entitlement.