Access is not authority. Bound agent, MCP, model, and tool execution to delegated purpose, scope, resources, and policy.