A permission kernel for agents seems like the right abstraction. Natural-language guardrails are useful as instructions, but consequential authority needs to be enforced outside the model.
Multi-agent systems feel closer to distributed systems than prompting. The hard problems are state, coordination, failure isolation, observability, and stopping conditions. The model call is usually the least interesting part.