Per-hop PBAC: enforcing scope at every delegation step

Checking authorization once at the edge leaves every downstream hop unguarded. Here is why agent delegation needs a policy decision at every hop, and how to do it.