Kradle AgentSecretGrant overview

AgentSecretGrant authorizes limited agent access to named secrets and records that the access path is governed rather than implicit. It is owned by the policy service and participates in admission, approval, or governance evidence. It is owned by the agent-dispatch service and participates in governed agent execution. Atlas models it as a agent CRD with Namespaced scope, v1alpha1 storage version, and source-backed Kubernetes API metadata so controller, policy, UI/API, and provider edges can target the exact resource kind.