An agent that registered itself was invisible, and withdrawing one meant deleting rows or rotating the signing key. It now sits next to Users, with the live-token count that tells an approved agent from one that only registered.