The technique: scope in your context, not the agent's config. Then changing a bound takes effect at the next check rather than the next deploy.
The test that sorts every approach. 9:14 Tuesday, you lower a spending bound $800 → $500. What happens to running agents, and to one spawned at 9:15?
Bearer key: still says $800 to every door until expiry
Identity + access list: nothing to update, the number was never on the list
Policy engine: file a ticket, rulebook changes when an admin edits
Participant-held authority: one edit, every check sees $500 including the 9:15 agent, nothing reissued because nothing was copied
Why config-based scoping is not runtime scoping. The permission lives with the agent, so it is a property of the agent rather than of your relationship with it. Three consequences: changing scope means redeploying. Every instance carries its own copy, so ten agents is ten definitions to sync. And a compromised agent's config is not a constraint on a compromised agent , if an attacker controls the process, the scope in that process is advisory.
Three properties any runtime-scoping claim must satisfy:
Bound lives outside the agent
Checked at the point of action, not at issuance
Changing it requires no reissuance
Why short token lifetimes do not fix it. Exposure = actions per second × window length. Unit is actions, not minutes. Fix the lifetime and exposure grows linearly with throughput, so a 15-minute token fine for a human is not fine for an agent at 40 calls/sec. Shorten it and re-issuance traffic grows, recreating the coordination cost tokens removed. The artifact has to change shape, not expiry.
What it does not solve. Scope is a boundary, not judgment. Injection still lands at the model layer: 56-70% tool-channel success against ReAct agents, and a May 2026 study of ~200,000 resumes found hidden injections in ~1%, over 90% without explicit ignore-instructions wording. Scoping decides what the injected agent reaches, which is the difference between an incident and a breach. Verification needs verifiers. DevNet stage.