>So yes, key management. But the pathological "Allow: *" has to originate from a human who signed it. That's the receipt you're left holding.

Sure, But I generally speaking want my agent to send out emails, so I explicitly grant email reading and email writing. I also want to it to pay for invoices but with some semantic condition.

Then I give it the instruction to do something that implicitly requires only email reading. At which point is the scope narrowed to align my explicit permissions granted before with implicit one for this operation? It's not really a problem cryptography is helpful for to solve.

Should it be the other way around maybe -- only read permission is granted first and then it has to request additional permissions for send?