Function enforce_agent_policy 

pub fn enforce_agent_policy(
    vault: &Vault,
    murk: &Murk,
    pubkey: &str,
    keys: &[String],
) -> Result<(), MurkError>

Apply check_agent_keys when the caller is a granted agent, or when the operator has opted into self-scope (crate::hardening::self_scope).

The library bindings (Python/Node) load a vault and read secrets directly, without the CLI’s agent exec policy gate. This is that gate for them: when the loaded identity is an agent grant — or the caller is self-scoping — the same policy the CLI enforces at agent exec applies here too, so a policy vault is enforced from every entry point. For a plain operator identity with no self-scope it is a no-op, matching the CLI’s ungated get/export.

The real boundary is cryptographic: an agent’s ephemeral key is not a recipient of out-of-scope secrets, so it cannot decrypt them regardless. This check is defense-in-depth, and it makes a later policy or tag change apply to agents retroactively at read time (the agent’s old scoped ciphertext lingers, but the binding refuses to hand it over).