[inetknght]

It's not just giving you a transient notification with the agent gets a request. I'd go several steps further:

1) clearly display what "local" machine is making the connection, under what user

2) clearly display what remote machine is the local connecting, to what user

3) allow me to select a specific key for that connection pair, and only present one key to the remote

4) if the key is unlocked (or, gasp not passphrase-protected), then allow me to accept/deny the agent request

5) give me some mechanism to permanently disable the agent for my user if I decide I don't want to risk some software "accidentally" forwarding an agent (pebcak, bug, malice, whatever)