Merge "Only disable trust agents after lockout" into nyc-mr1-dev