Function enforce_agent_policy 

pub fn enforce_agent_policy(
    vault: &Vault,
    murk: &Murk,
    pubkey: &str,
    keys: &[String],
) -> Result<(), MurkError>

Apply check_agent_keys, but only when the caller is a granted agent.

The library bindings (Python/Node) load a vault and read secrets directly, without the CLI’s agent exec policy gate. This is that gate for them: when the loaded identity is an agent grant, the same policy the CLI enforces at agent exec applies here too — so a policy vault is strict from every entry point. For an operator identity it is a no-op, matching the CLI, where plain get/export are never policy-gated.

The real boundary is cryptographic: an agent’s ephemeral key is not a recipient of out-of-scope secrets, so it cannot decrypt them regardless. This check is defense-in-depth, and it makes a later policy or tag change apply to agents retroactively at read time (the agent’s old scoped ciphertext lingers, but the binding refuses to hand it over).