ADK

ADK Agent Identity on Google Cloud: Separate Identities, Separate Blast Radius

When one ADK agent delegates to another, identity is not inherited along the way: two Cloud Run services, two service accounts, and the IAM binding that actually defines blast radius.