Does the design have a hard constraint that the agent reaches downstream APIs only through a proxy? (Ref from another comment: Enforcement happens at the proxy, which sits between the agent and the downstream API)
What happens if the agent agent can bypass the proxy?
What happens if the agent agent can bypass the proxy?