Where the Card is the final authority.
TodayWherever KIFF is on the only path.Through the gateway, KIFF holds the credential: the agent can't reach the tool around its Card.
Not by itselfAn agent that can still act through a browser or a direct credential.Close that path, or KIFF doesn't govern it. We say so.
NextTools that verify KIFF, and payments that follow the Card.Direction, not product yet.