An agent we shipped last quarter returned a row from the wrong tenant. The agent did what the prompt asked. The database did what the agent asked. The third jurisdiction of every agentic workflow is the database, and Pydantic and TypedDict cannot reach it.
