The All-or-Nothing Grant Is Dying at Both Ends

Two August 2026 publications target the same object: the permission grant an agent carries into a task. On the research side, Tripathi, Kumar, Kumar, and Gadhe published a policy algebra for trust-preserving agentic execution (arXiv 2608.16402) that composes and narrows an agent’s permissions while the task runs. It intervenes on 94.8% of policy-violating events, sustains an 86.9% task-completion rate, and reports 98.6% audit completeness. On the production side, Cloudflare detailed its task-based OAuth consent: developers mark each scope as required or optional, users deselect the optional ones at the consent screen, and the issued token carries only what was granted. Over 1 million authorizations have flowed through it since the June launch.

We argued in an earlier essay that the agent-governance market was shipping control surfaces without enforcement: dashboards, policy documents, and consent prompts with no machinery underneath that could actually stop or shrink a grant once execution started. That claim needs a correction, and this is it. The enforcement primitives arrived, one as a formalism with published numbers, one as a production control with adoption figures.

The grant becomes an object you can operate on

The policy algebra’s contribution is a set of composition operators that treat a permission grant as a mathematical object: joins, intersections, budget narrowing, approval inheritance, and evidence accumulation. Each operator takes grants as input and produces a grant as output, which means the permission an agent holds at step forty of a task can be provably narrower than the permission it held at step one.

Budget narrowing is the operator worth pausing on. A static grant answers one question: can this agent call this tool? A budget answers a better one: how much of this resource does this specific task justify, and what happens to the remainder as the task consumes it? The grant shrinks as it is spent. Approval inheritance handles the delegation case: when an agent hands a subtask to another agent, the child does not receive the parent’s full grant. Restrictions propagate across multi-agent calls, so the narrowest constraint in the chain travels with the work.

The evaluation numbers deserve a sober read. Intervening on 94.8% of policy-violating events means roughly one violation in twenty still gets through. An 86.9% task-completion rate means roughly 13% of tasks do not complete under the constraint system. Neither number is an argument against the approach. They are an honest price list for mid-task enforcement, and a price list is what lets an engineering organization decide instead of guess.

The 98.6% audit completeness figure may matter most for regulated environments. Evidence accumulation is a first-class operator in the algebra, so the audit trail is a product of execution rather than a log bolted on afterward. When a grant narrowed, the record shows which operator narrowed it and on what evidence.

The consent screen becomes a negotiation

Cloudflare’s release attacks the same problem from the token side. The pre-existing OAuth pattern was binary: an application requests a set of scopes, and the user either approves the whole set or walks away. Cloudflare’s own framing of why that fails names the agent case directly: “An MCP server might request a broad set of permissions… most users would not want an agent to have that much access.”

The mechanism is small and that is its virtue. Developers split their requested scopes into required and optional. At consent time the user unchecks whatever optional scopes the task at hand does not justify. The token that gets minted carries only the granted subset, so every downstream system that validates the token enforces the user’s selection without knowing the negotiation happened. No policy engine, no sidecar, no agent-framework dependency. The enforcement lives where OAuth enforcement already lives.

Adoption is the part that separates this from a proposal. More than 1 million authorizations have passed through the flow since June. That number says users will actually operate a partial-consent screen when one is offered, which was an untested assumption behind least-privilege recommendations for agents, ours included.

What this corrects in the permission arc

Three earlier pieces of ours set up the problem these releases answer. Per-tool permissions are the bug argued that allowlists scoped to tools cannot express what a task actually needs, because the dangerous unit is the task-tool combination rather than the tool in isolation. Approval theater argued that consent prompts had become a ritual: the human approves a broad grant once, at the moment they have the least information about what the agent will do with it.

Both critiques stand. What changed is that the remedies now exist as artifacts rather than as recommendations. The algebra gives the task-scoped grant a formal semantics and measured enforcement. Cloudflare gives the partial grant a production token format and a consent UI that a million authorizations have already exercised. The diagnosis phase of this argument is over. The implementation phase has begun.

The two artifacts also compose. Cloudflare’s mechanism decides what enters the token at consent time. The algebra decides how the grant evolves after that: narrowing as budgets deplete, tightening as subtasks delegate, accumulating evidence as the task runs. One governs admission, the other governs execution. A permission model that does only the first still leaves the agent overprovisioned for most of the task’s lifetime, because the scope needed at the widest moment is granted for the whole duration.

The uncomfortable numbers are the useful ones

An 86.9% completion rate under enforcement will read as unacceptable to a team measured on throughput. That reaction is worth interrogating rather than obeying. Among the tasks that fail under constraint are the tasks that attempted something the policy forbids. Some of those failures point to policy bugs, and the audit trail exists to find them. Others are the events the system exists to stop.

The 94.8% intervention rate cuts the other way. One violating event in twenty passing through means this cannot be the only layer. Task-scoped grants sit inside the same defense-in-depth stack as sandboxing and data-layer controls. Treating any single figure in this space as a pass-fail threshold misses what the numbers are for: they let you compare enforcement designs on evidence, which was impossible when the alternative was prose.

Do this now

Pick one production agent and write down the grant it holds today, then answer two questions against it. First: which of its scopes does its most common task actually exercise? Anything unexercised is a candidate for Cloudflare-style optional marking, whether or not the provider offers the flow yet. Second: at what point mid-task could the grant narrow without breaking the task? If the answer is “never, the grant is a single static blob,” you now have a measured reference point for what the alternative costs: an 86.9% completion rate under enforcement, in exchange for intervention on 94.8% of violations and an audit trail that is 98.6% complete. Take that trade to the next architecture review as a decision, because it is no longer a research question.

---

This analysis synthesizes A Policy Algebra for Trust-Preserving Agentic AI Execution (Tripathi, Kumar, Kumar, Gadhe, arXiv, August 2026) and From All-or-Nothing to Task-Based OAuth Consent (Cloudflare, August 2026).

Victorino Group helps engineering organizations design task-scoped permission models for agent fleets, from consent flow to mid-task enforcement. Let’s talk.