Device → Agent

Map each managed device's AI apps to a governed agent. Intercepted traffic — and the on-device tools — then resolve to that agent.