1Password’s agent sign-in pitch separates a hidden password from an authorized action
1Password says its agent sign-in flow keeps credentials outside the model. The remaining question is what an authenticated agent is allowed to do, and how session boundaries are explained.