Yet another thought, about enemy integration and game pacing.
As I discussed, it's somewhat nice to have the possibility of a "safe but boring" outcome on each challenge card. This is particularly attractive early in the game, when bad consequences feel more punitive than a justified consequence. But you don't want that to last forever. Perhaps, as I said, each encounter card is fundamentally "safe", BUT, when the enemy is sufficiently "energized" -- ie, their presence in a particular city exceeds a threshold or the enemy track reaches a certain point -- this changes (either locally or globally, depending on which we settle on). The easiest way would be to have a separate deck of "enemy encounter cards", and when the enemy is energized, you face one of these cards instead of a standard card. And that could work well, but adds more components (and with all these illustrations, these encounter cards will be expensive components).
A different idea occurred to me; Lord of the Rings uses a masterful approach, whereby it's iconography is highly flexible, in that expansions simply change the meaning of icons. In the base game, "rectangle" means "discard a card", in Friends and Foes it takes on a new meaning "add a Foe card." The same principle could apply here, and it could be connected with the Agent cards.
So, when an enemy agent card is activated, it shows that a particular outcome symbol has taken on a new (or additional) meaning on the encounter cards. So, for example, your encounter outcome is "receive a check mark in the 'yellow' category", but you look at the row of Enemy Agents, and Agent Z is active; her effect is "receiving a check mark in the yellow category also results in the enemy progress advancing by 3".
This sounds a little convoluted, I know, but it allows some nice flexibility -- it makes some cities more dangerous than others, but the level of "dangerousness" is entirely dependent on how many Enemy Agents are active, which forces the players to have to worry about the enemy agents.
It would of course be simpler to say that when you face a challenge in an "enemy-controlled city", the full menu of bad consequences are on the table. But that would also effectively lock up whole cities, whereas in this scheme, only certain sub-locations become "dangerous" -- eg if you were going to go to the Ruin to get a check mark in the temple location category, better think twice about doing that if Agent Y is active (or at least take it into account). And of course, the purpose of the mechanic should be to nibble away at the "safe" outcomes, so that the game board gets more dangerous as the game progresses, without necessarily getting harder.