Agents are markdown files, topology is a JSON file the runtime enforces hard. The agents are still fully autonomous: they make their own decisions, but the graph they operate in isn't. You declare who can call whom upfront and the runtime holds that line.
No auth yet, fine if you don't expose the port, i guess. Two Docker commands to run it.