Restrict an API key to the agent runs it started
By default, any API key in your organization can read and control every agent run in the organization, not only the runs it started. You can now turn on stricter scoping. Each key then sees only the runs it created. A run from another key returns a 404, the same response as an unknown id.
Ask your account team to enable this setting. It is opt-in for now and becomes the default in a future release, so test your integration against it early.