Building agent-first governance and security