Agent frameworks put trust in the prompt. Astrid puts it in the runtime. An agent is untrusted code executing on your machine with access to your files, your network, and your credentials. Telling it to behave is not a security boundary. An OS-grade boundary is.

directory, quotas, and audit chain. One principal can never read another's namespace, and it fails closed if the caller cannot be resolved.