The hard limits are the right starting point. For NIP-90, I’d make the request schema versioned and include expiry, geo precision, max price, and response-delivery policy; for WoT, expose reproducible graph/path evidence and cap same-cluster attestations so Sybil/collusion can’t buy rank. The agent should never see door codes, private messages, keys, or funds, and should not make irreversible or moderation decisions. One practical snag: the linked GitHub RFC path currently returns 404—the repo README lists RFCs only through 0011—so publish a canonical draft or fix the link before soliciting review.