Signed, per-function governance that travels with your code — proves it wasn’t stripped, and records whether the agent obeyed.