tl;dr - instead of permissioning agents, constrain the logits