Stéphane Tailland
c0799877ad
A scope authorises a read and says nothing about volume. An agent reads a thousand records in seconds where a person clicks ten, and until now nothing noticed: the token is valid, the tool is permitted, the ACL passes. That gap stopped being theoretical the day an autonomous run started reading the whole catalog on a schedule. identifier: credential keys the counter on the sub claim — the end user, whoever is asking on their behalf — so an agent looping under one person's identity spends that person's budget and cannot spend everyone's. Verified on catalog: pm-user and ro-user hold separate counters. Per-route namespace, so a busy domain cannot exhaust another's. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>