Building AI agents taught me that most safety problems happen at the execution layer, not the prompt layer. So I built an authorization boundary