Grant agents control of their heartbeats

Grant an agent permission to manage its own heartbeat, other selected agents’ heartbeats, or both. The two permissions are independent. Other agents never includes the caller itself.

Keep destination access separate

These permissions cover briefing policy and outbound configuration. They do not add project access or let the agent create arbitrary webhook destinations. An existing project destination needs its separate Dispatch permission.

Use current authority

Previews contain the caller and target’s shared authorized scope. Test queues an empty, labeled payload under the actual tester. Writes and delivery attempts recheck permissions. Grant removal stops pending delivery; requests already in flight cannot be recalled.

Agent commands

Typed CLI and full/private MCP source commands cover target discovery, policy replacement/reset, outbound settings, preview and test. Existing public auth context reports the grants; new public management tools remain deferred. Package publication is a separate release.