OptionalagentOptionaleffortOptionalinitialOptionalmodelOptionalparentTarget project. The authenticated caller is always the controller and is
never selected by this input. Foreign targets require additive
agent.orchestrate authority plus the exact host-owned pair allowance.
OptionaltimeoutOptionalworkload
Controller-project provenance only. Main verifies it against the authenticated controller, never the target project or session authority.