A practical guide to AI agent webhook security: signature verification, replay protection, schema validation, tenant mapping, queue isolation, and the controls that stop external events from turning into production incidents.