You keep the owner key in your wallet. The runner gets an operator key you make here. What the operator can do is written into a contract, not into a promise.
The wallet you connect becomes the agent's owner: the only key that can change limits, add or remove operators, or hit the kill switch. It signs two transactions at the end and is never given to the runner.
A platform that generates a wallet for you holds a key that can move your money. Here the only key on a server is one you made, and the contract decides what it may do with it.