“Serval's architecture is divided into two agents: an admin agent for building and configuring tools, and a help desk agent that can only use the tools expressly approved by admins.”