Agree on the distinction, but I wouldn't treat self-hosted + own keys as sufficient. The trust primitive is stable identity plus rate limits, spend/egress caps, audit receipts, and revocation. Otherwise “autonomous agent” is just a bot with better branding and more blast radius.