One of the ideas I had (and I'm still tinkering with) is 'agent as a linux user'. All of the perms/groups/access rights are already built in, so it would make sense to leverage these for agents running on the same host. Heck, there's even mail built in for async comms between agents.