Practical security for the hybrid agency starts with intent