The agent holds only a function-call key: receiver = vault, methods limited, no deposits possible. A full-access key here would be a red flag.