Function is_agent_identity 

pub fn is_agent_identity(murk: &Murk, pubkey: &str) -> bool

True when pubkey identifies a granted agent for this decrypted vault state.

Agent grants live in the encrypted meta and are carried into Murk::grants after decryption, so this is the same “am I an agent” test the CLI makes when it decrypts as an agent (lib::decrypt_vault). An operator (or any plain recipient) is not in grants, so this returns false for them.